openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Addresses API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Addresses
  description: Address object management.
paths:
  /sse/config/v1/addresses:
    get:
      operationId: listAddresses
      summary: Palo Alto Networks List Address Objects
      description: Returns a paginated list of address objects in the specified folder, snippet, or device scope. Address objects represent IP addresses, subnets, IP ranges, or FQDNs used in security policy rules.
      tags:
      - Addresses
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: name
        in: query
        description: Filter by address object name (exact match).
        schema:
          type: string
        example: Primary Policy 56
      responses:
        '200':
          description: Address objects returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressList'
              examples:
                ListAddresses200Example:
                  summary: Default listAddresses 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: 9385c1f9-7f72-49a5-a1d6-896aaa11ae6a
                      name: Branch Sensor 50
                      folder: example-folder
                      snippet: example-snippet
                      ip_netmask: example-ip_netmask
                      ip_range: example-ip_range
                      ip_wildcard: example-ip_wildcard
                      fqdn: login.test-corp.net
                      description: Alert investigation incident violation rule Security investigation endpoint Security activity on on.
                      tag:
                      - pci-scope
                      - production
                    offset: 347
                    total: 788
                    limit: 478
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddress
      summary: Palo Alto Networks Create Address Object
      description: Creates a new address object in the specified folder or snippet. Exactly one address type field (ip_netmask, ip_range, ip_wildcard, or fqdn) must be provided. The name must be unique within the scope.
      tags:
      - Addresses
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddressRequest'
            examples:
              CreateAddressRequestExample:
                summary: Default createAddress request
                x-microcks-default: true
                value:
                  name: Corporate Policy 65
                  ip_netmask: example-ip_netmask
                  ip_range: example-ip_range
                  ip_wildcard: example-ip_wildcard
                  fqdn: mail.test-corp.net
                  description: Traffic suspicious alert policy Security malware.
                  tag:
                  - production
      responses:
        '201':
          description: Address object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Address'
              examples:
                CreateAddress201Example:
                  summary: Default createAddress 201 response
                  x-microcks-default: true
                  value:
                    id: 9385c1f9-7f72-49a5-a1d6-896aaa11ae6a
                    name: Branch Sensor 50
                    folder: example-folder
                    snippet: example-snippet
                    ip_netmask: example-ip_netmask
                    ip_range: example-ip_range
                    ip_wildcard: example-ip_wildcard
                    fqdn: login.test-corp.net
                    description: Alert investigation incident violation rule Security investigation endpoint Security activity on on.
                    tag:
                    - pci-scope
                    - production
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sse/config/v1/addresses/{id}:
    get:
      operationId: getAddress
      summary: Palo Alto Networks Get Address Object
      description: Returns a single address object by its unique identifier.
      tags:
      - Addresses
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: Address object returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Address'
              examples:
                GetAddress200Example:
                  summary: Default getAddress 200 response
                  x-microcks-default: true
                  value:
                    id: 9385c1f9-7f72-49a5-a1d6-896aaa11ae6a
                    name: Branch Sensor 50
                    folder: example-folder
                    snippet: example-snippet
                    ip_netmask: example-ip_netmask
                    ip_range: example-ip_range
                    ip_wildcard: example-ip_wildcard
                    fqdn: login.test-corp.net
                    description: Alert investigation incident violation rule Security investigation endpoint Security activity on on.
                    tag:
                    - pci-scope
                    - production
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddress
      summary: Palo Alto Networks Update Address Object
      description: Updates an existing address object by its unique identifier. The entire object must be provided as this performs a full replacement.
      tags:
      - Addresses
      parameters:
      - $ref: '#/components/parameters/id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddressRequest'
            examples:
              UpdateAddressRequestExample:
                summary: Default updateAddress request
                x-microcks-default: true
                value:
                  name: Corporate Policy 65
                  ip_netmask: example-ip_netmask
                  ip_range: example-ip_range
                  ip_wildcard: example-ip_wildcard
                  fqdn: mail.test-corp.net
                  description: Traffic suspicious alert policy Security malware.
                  tag:
                  - production
      responses:
        '200':
          description: Address object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Address'
              examples:
                UpdateAddress200Example:
                  summary: Default updateAddress 200 response
                  x-microcks-default: true
                  value:
                    id: 9385c1f9-7f72-49a5-a1d6-896aaa11ae6a
                    name: Branch Sensor 50
                    folder: example-folder
                    snippet: example-snippet
                    ip_netmask: example-ip_netmask
                    ip_range: example-ip_range
                    ip_wildcard: example-ip_wildcard
                    fqdn: login.test-corp.net
                    description: Alert investigation incident violation rule Security investigation endpoint Security activity on on.
                    tag:
                    - pci-scope
                    - production
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddress
      summary: Palo Alto Networks Delete Address Object
      description: Deletes an address object by its unique identifier. The object must not be referenced by any security rules or address groups.
      tags:
      - Addresses
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: Address object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteResponse'
              examples:
                DeleteAddress200Example:
                  summary: Default deleteAddress 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  parameters:
    id:
      name: id
      in: path
      required: true
      description: Unique identifier of the resource.
      schema:
        type: string
        format: uuid
    snippet:
      name: snippet
      in: query
      description: Configuration snippet name.
      schema:
        type: string
    folder:
      name: folder
      in: query
      description: Configuration folder scope (e.g., Shared, Mobile Users, Remote Networks, Service Connections).
      schema:
        type: string
    offset:
      name: offset
      in: query
      description: Pagination offset (number of records to skip).
      schema:
        type: integer
        default: 0
    device:
      name: device
      in: query
      description: Device name for device-scoped configuration.
      schema:
        type: string
    limit:
      name: limit
      in: query
      description: Maximum number of results per page.
      schema:
        type: integer
        default: 200
        maximum: 5000
  schemas:
    AddressRequest:
      type: object
      required:
      - name
      description: Request body for creating or updating an address object.
      properties:
        name:
          type: string
          example: Corporate Policy 65
        ip_netmask:
          type: string
          description: IP address with CIDR netmask (e.g., 10.0.0.0/24).
          example: example-ip_netmask
        ip_range:
          type: string
          description: IP address range (e.g., 10.0.0.1-10.0.0.254).
          example: example-ip_range
        ip_wildcard:
          type: string
          description: IP wildcard mask notation.
          example: example-ip_wildcard
        fqdn:
          type: string
          description: Fully qualified domain name.
          example: mail.test-corp.net
        description:
          type: string
          example: Traffic suspicious alert policy Security malware.
        tag:
          type: array
          items:
            type: string
          example:
          - production
    DeleteResponse:
      type: object
      properties:
        id:
          type: string
          description: Identifier of the deleted resource.
          example: example-id
    AddressList:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Address'
          example:
          - id: 9385c1f9-7f72-49a5-a1d6-896aaa11ae6a
            name: Branch Sensor 50
            folder: example-folder
            snippet: example-snippet
            ip_netmask: example-ip_netmask
            ip_range: example-ip_range
            ip_wildcard: example-ip_wildcard
            fqdn: login.test-corp.net
            description: Alert investigation incident violation rule Security investigation endpoint Security activity on on.
            tag:
            - pci-scope
            - production
        offset:
          type: integer
          example: 347
        total:
          type: integer
          example: 788
        limit:
          type: integer
          example: 478
    Address:
      type: object
      description: An address object representing an IP address, subnet, range, or FQDN used in security policy rules.
      properties:
        id:
          type: string
          format: uuid
          description: Unique identifier assigned by the system.
          readOnly: true
          example: 9385c1f9-7f72-49a5-a1d6-896aaa11ae6a
        name:
          type: string
          description: Unique name of the address object within the folder scope.
          example: Branch Sensor 50
        folder:
          type: string
          description: Configuration folder containing this object.
          readOnly: true
          example: example-folder
        snippet:
          type: string
          readOnly: true
          example: example-snippet
        ip_netmask:
          type: string
          description: IP address with CIDR netmask (e.g., 10.0.0.0/24).
          example: example-ip_netmask
        ip_range:
          type: string
          description: IP address range (e.g., 10.0.0.1-10.0.0.254).
          example: example-ip_range
        ip_wildcard:
          type: string
          description: IP wildcard mask notation.
          example: example-ip_wildcard
        fqdn:
          type: string
          description: Fully qualified domain name (e.g., www.example.com).
          example: login.test-corp.net
        description:
          type: string
          example: Alert investigation incident violation rule Security investigation endpoint Security activity on on.
        tag:
          type: array
          items:
            type: string
          description: Tags assigned to this address object.
          example:
          - pci-scope
          - production
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security monitoring rule configured endpoint on network blocked.
            details: {}
          - code: example-code
            message: Security on on threat monitoring activity policy.
            details: {}
        _request_id:
          type: string
          description: Unique request identifier for troubleshooting.
          example: '574499'
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or the resource cannot be modified due to existing references.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: An internal server error occurred.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.