openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend AddressGroups API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: AddressGroups
  description: Address group management.
paths:
  /sse/config/v1/address-groups:
    get:
      operationId: listAddressGroups
      summary: Palo Alto Networks List Address Groups
      description: Returns a paginated list of address groups in the specified scope. Groups can be static with explicit member lists or dynamic with tag-based filter expressions.
      tags:
      - AddressGroups
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: name
        in: query
        description: Filter by address group name.
        schema:
          type: string
        example: Staging Policy 94
      responses:
        '200':
          description: Address groups returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressGroupList'
              examples:
                ListAddressGroups200Example:
                  summary: Default listAddressGroups 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: 33746651-164a-49e5-aab4-9062bb91355a
                      name: Staging Firewall 43
                      folder: example-folder
                      static: &id001
                      - example-static_item
                      - example-static_item
                      dynamic: &id002
                        filter: example-filter
                      description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
                      tag: &id003
                      - critical-asset
                    - id: 33746651-164a-49e5-aab4-9062bb91355a
                      name: Staging Firewall 43
                      folder: example-folder
                      static: *id001
                      dynamic: *id002
                      description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
                      tag: *id003
                    offset: 350
                    total: 934
                    limit: 51
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddressGroup
      summary: Palo Alto Networks Create Address Group
      description: Creates a new address group. Provide either a static member list or a dynamic filter expression, not both.
      tags:
      - AddressGroups
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddressGroupRequest'
            examples:
              CreateAddressGroupRequestExample:
                summary: Default createAddressGroup request
                x-microcks-default: true
                value:
                  name: Staging Gateway 56
                  static:
                  - example-static_item
                  dynamic:
                    filter: example-filter
                  description: Rule violation policy traffic activity traffic applied firewall traffic traffic.
                  tag:
                  - production
                  - critical-asset
      responses:
        '201':
          description: Address group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressGroup'
              examples:
                CreateAddressGroup201Example:
                  summary: Default createAddressGroup 201 response
                  x-microcks-default: true
                  value:
                    id: 33746651-164a-49e5-aab4-9062bb91355a
                    name: Staging Firewall 43
                    folder: example-folder
                    static:
                    - example-static_item
                    - example-static_item
                    dynamic:
                      filter: example-filter
                    description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
                    tag:
                    - critical-asset
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sse/config/v1/address-groups/{id}:
    get:
      operationId: getAddressGroup
      summary: Palo Alto Networks Get Address Group
      description: Returns a single address group by its unique identifier.
      tags:
      - AddressGroups
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: Address group returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressGroup'
              examples:
                GetAddressGroup200Example:
                  summary: Default getAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    id: 33746651-164a-49e5-aab4-9062bb91355a
                    name: Staging Firewall 43
                    folder: example-folder
                    static:
                    - example-static_item
                    - example-static_item
                    dynamic:
                      filter: example-filter
                    description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
                    tag:
                    - critical-asset
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddressGroup
      summary: Palo Alto Networks Update Address Group
      description: Updates an existing address group by its unique identifier.
      tags:
      - AddressGroups
      parameters:
      - $ref: '#/components/parameters/id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddressGroupRequest'
            examples:
              UpdateAddressGroupRequestExample:
                summary: Default updateAddressGroup request
                x-microcks-default: true
                value:
                  name: Staging Gateway 56
                  static:
                  - example-static_item
                  dynamic:
                    filter: example-filter
                  description: Rule violation policy traffic activity traffic applied firewall traffic traffic.
                  tag:
                  - production
                  - critical-asset
      responses:
        '200':
          description: Address group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressGroup'
              examples:
                UpdateAddressGroup200Example:
                  summary: Default updateAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    id: 33746651-164a-49e5-aab4-9062bb91355a
                    name: Staging Firewall 43
                    folder: example-folder
                    static:
                    - example-static_item
                    - example-static_item
                    dynamic:
                      filter: example-filter
                    description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
                    tag:
                    - critical-asset
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddressGroup
      summary: Palo Alto Networks Delete Address Group
      description: Deletes an address group by its unique identifier.
      tags:
      - AddressGroups
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: Address group deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteResponse'
              examples:
                DeleteAddressGroup200Example:
                  summary: Default deleteAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    AddressGroupList:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/AddressGroup'
          example:
          - id: 33746651-164a-49e5-aab4-9062bb91355a
            name: Staging Firewall 43
            folder: example-folder
            static: &id004
            - example-static_item
            - example-static_item
            dynamic: &id005
              filter: example-filter
            description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
            tag: &id006
            - critical-asset
          - id: 33746651-164a-49e5-aab4-9062bb91355a
            name: Staging Firewall 43
            folder: example-folder
            static: *id004
            dynamic: *id005
            description: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
            tag: *id006
        offset:
          type: integer
          example: 350
        total:
          type: integer
          example: 934
        limit:
          type: integer
          example: 51
    DeleteResponse:
      type: object
      properties:
        id:
          type: string
          description: Identifier of the deleted resource.
          example: example-id
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security monitoring rule configured endpoint on network blocked.
            details: {}
          - code: example-code
            message: Security on on threat monitoring activity policy.
            details: {}
        _request_id:
          type: string
          description: Unique request identifier for troubleshooting.
          example: '574499'
    AddressGroup:
      type: object
      description: A group of address objects. Can be static with an explicit member list or dynamic with a tag-based filter expression.
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: 33746651-164a-49e5-aab4-9062bb91355a
        name:
          type: string
          example: Staging Firewall 43
        folder:
          type: string
          readOnly: true
          example: example-folder
        static:
          type: array
          items:
            type: string
          description: List of address object names for static groups.
          example:
          - example-static_item
          - example-static_item
        dynamic:
          type: object
          properties:
            filter:
              type: string
              description: Tag-based filter expression (e.g., "'web-servers' and 'production'").
              example: example-filter
          example:
            filter: example-filter
        description:
          type: string
          example: Detected activity rule alert activity violation blocked threat monitoring traffic alert.
        tag:
          type: array
          items:
            type: string
          example:
          - critical-asset
    AddressGroupRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          example: Staging Gateway 56
        static:
          type: array
          items:
            type: string
          example:
          - example-static_item
        dynamic:
          type: object
          properties:
            filter:
              type: string
              example: example-filter
          example:
            filter: example-filter
        description:
          type: string
          example: Rule violation policy traffic activity traffic applied firewall traffic traffic.
        tag:
          type: array
          items:
            type: string
          example:
          - production
          - critical-asset
  parameters:
    id:
      name: id
      in: path
      required: true
      description: Unique identifier of the resource.
      schema:
        type: string
        format: uuid
    snippet:
      name: snippet
      in: query
      description: Configuration snippet name.
      schema:
        type: string
    folder:
      name: folder
      in: query
      description: Configuration folder scope (e.g., Shared, Mobile Users, Remote Networks, Service Connections).
      schema:
        type: string
    offset:
      name: offset
      in: query
      description: Pagination offset (number of records to skip).
      schema:
        type: integer
        default: 0
    device:
      name: device
      in: query
      description: Device name for device-scoped configuration.
      schema:
        type: string
    limit:
      name: limit
      in: query
      description: Maximum number of results per page.
      schema:
        type: integer
        default: 200
        maximum: 5000
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or the resource cannot be modified due to existing references.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.