openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Applications API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Applications
  description: Monitored application inventory management.
paths:
  /mt/monitor/adem/v1/applications:
    get:
      operationId: listMonitoredApplications
      summary: Palo Alto Networks List Monitored Applications
      description: Returns a list of all applications configured for monitoring in Autonomous DEM. Each entry includes the application name, category, and the synthetic tests configured for probing it.
      tags:
      - Applications
      parameters:
      - name: app_id
        in: query
        description: Filter by specific application identifier.
        schema:
          type: string
        example: '473439'
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: Monitored applications returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MonitoredApplication'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListMonitoredApplications200Example:
                  summary: Default listMonitoredApplications 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - app_id: '100488'
                      name: Production Firewall 97
                      category: custom
                      type: saas
                      url: https://vpn.acme-systems.org/a5d006
                      test_count: 241
                      monitored_users: 122
                      created_at: '2026-02-02T08:43:53Z'
                    - app_id: '100488'
                      name: Production Firewall 97
                      category: custom
                      type: saas
                      url: https://vpn.acme-systems.org/a5d006
                      test_count: 241
                      monitored_users: 122
                      created_at: '2026-02-02T08:43:53Z'
                    total: 926
                    offset: 718
                    limit: 679
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/applications:
    get:
      operationId: listApplications
      summary: Palo Alto Networks List Connected SaaS Applications
      description: Returns the list of SaaS applications connected to the SaaS Security tenant. Each application entry includes its connection status, the number of scanned assets, and the number of active incidents.
      tags:
      - Applications
      responses:
        '200':
          description: Connected applications returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Application'
              examples:
                ListApplications200Example:
                  summary: Default listApplications 200 response
                  x-microcks-default: true
                  value:
                    total: 994
                    items:
                    - id: example-id
                      name: Primary Agent 80
                      type: advanced
                      status: connected
                      asset_count: 752
                      incident_count: 54
                      connected_at: '2025-07-22T17:44:41Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListApplications401Example:
                  summary: Default listApplications 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListApplications403Example:
                  summary: Default listApplications 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListApplications500Example:
                  summary: Default listApplications 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/applications:
    get:
      operationId: listZTNAApplications
      summary: Palo Alto Networks List ZTNA-protected Applications
      description: Returns the list of applications protected by ZTNA. Each application defines the private resource users can access along with the connector group that provides access.
      tags:
      - Applications
      responses:
        '200':
          description: ZTNA applications returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/ZTNAApplication'
              examples:
                ListZtnaapplications200Example:
                  summary: Default listZTNAApplications 200 response
                  x-microcks-default: true
                  value:
                    total: 626
                    items:
                    - app_id: '768496'
                      name: Corporate Sensor 20
                      description: On investigation rule violation threat monitoring.
                      group_id: '907399'
                      fqdn: api.acme-systems.org
                      ports:
                      - 603
                      - 3
                      protocols:
                      - TCP
                      enabled: true
                      created_at: '2024-05-17T06:02:30Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                ListZtnaapplications401Example:
                  summary: Default listZTNAApplications 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                ListZtnaapplications403Example:
                  summary: Default listZTNAApplications 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                ListZtnaapplications500Example:
                  summary: Default listZTNAApplications 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createZTNAApplication
      summary: Palo Alto Networks Create ZTNA Application
      description: Creates a new ZTNA-protected application definition.
      tags:
      - Applications
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ZTNAApplicationRequest'
            examples:
              CreateZtnaapplicationRequestExample:
                summary: Default createZTNAApplication request
                x-microcks-default: true
                value:
                  name: Branch Agent 75
                  description: Incident suspicious firewall Security suspicious policy threat suspicious.
                  group_id: '376339'
                  fqdn: login.test-corp.net
                  ports:
                  - 28
                  protocols:
                  - TCP
                  - UDP
                  enabled: true
      responses:
        '201':
          description: ZTNA application created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ZTNAApplication'
              examples:
                CreateZtnaapplication201Example:
                  summary: Default createZTNAApplication 201 response
                  x-microcks-default: true
                  value:
                    app_id: '768496'
                    name: Corporate Sensor 20
                    description: On investigation rule violation threat monitoring.
                    group_id: '907399'
                    fqdn: api.acme-systems.org
                    ports:
                    - 603
                    - 3
                    protocols:
                    - TCP
                    enabled: true
                    created_at: '2024-05-17T06:02:30Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                CreateZtnaapplication400Example:
                  summary: Default createZTNAApplication 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                CreateZtnaapplication401Example:
                  summary: Default createZTNAApplication 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                CreateZtnaapplication403Example:
                  summary: Default createZTNAApplication 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                CreateZtnaapplication500Example:
                  summary: Default createZTNAApplication 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/applications/{app_id}:
    get:
      operationId: getZTNAApplication
      summary: Palo Alto Networks Get ZTNA Application
      description: Returns full details for a specific ZTNA-protected application.
      tags:
      - Applications
      parameters:
      - name: app_id
        in: path
        required: true
        description: Unique identifier of the ZTNA application.
        schema:
          type: string
        example: '990231'
      responses:
        '200':
          description: ZTNA application details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ZTNAApplication'
              examples:
                GetZtnaapplication200Example:
                  summary: Default getZTNAApplication 200 response
                  x-microcks-default: true
                  value:
                    app_id: '768496'
                    name: Corporate Sensor 20
                    description: On investigation rule violation threat monitoring.
                    group_id: '907399'
                    fqdn: api.acme-systems.org
                    ports:
                    - 603
                    - 3
                    protocols:
                    - TCP
                    enabled: true
                    created_at: '2024-05-17T06:02:30Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetZtnaapplication401Example:
                  summary: Default getZTNAApplication 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetZtnaapplication403Example:
                  summary: Default getZTNAApplication 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: ZTNA application not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetZtnaapplication404Example:
                  summary: Default getZTNAApplication 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetZtnaapplication500Example:
                  summary: Default getZTNAApplication 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateZTNAApplication
      summary: Palo Alto Networks Update ZTNA Application
      description: Updates an existing ZTNA-protected application definition.
      tags:
      - Applications
      parameters:
      - name: app_id
        in: path
        required: true
        description: Unique identifier of the ZTNA application to update.
        schema:
          type: string
        example: '711163'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ZTNAApplicationRequest'
            examples:
              UpdateZtnaapplicationRequestExample:
                summary: Default updateZTNAApplication request
                x-microcks-default: true
                value:
                  name: Branch Agent 75
                  description: Incident suspicious firewall Security suspicious policy threat suspicious.
                  group_id: '376339'
                  fqdn: login.test-corp.net
                  ports:
                  - 28
                  protocols:
                  - TCP
                  - UDP
                  enabled: true
      responses:
        '200':
          description: ZTNA application updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ZTNAApplication'
              examples:
                UpdateZtnaapplication200Example:
                  summary: Default updateZTNAApplication 200 response
                  x-microcks-default: true
                  value:
                    app_id: '768496'
                    name: Corporate Sensor 20
                    description: On investigation rule violation threat monitoring.
                    group_id: '907399'
                    fqdn: api.acme-systems.org
                    ports:
                    - 603
                    - 3
                    protocols:
                    - TCP
                    enabled: true
                    created_at: '2024-05-17T06:02:30Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                UpdateZtnaapplication400Example:
                  summary: Default updateZTNAApplication 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                UpdateZtnaapplication401Example:
                  summary: Default updateZTNAApplication 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                UpdateZtnaapplication403Example:
                  summary: Default updateZTNAApplication 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: ZTNA application not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                UpdateZtnaapplication404Example:
                  summary: Default updateZTNAApplication 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                UpdateZtnaapplication500Example:
                  summary: Default updateZTNAApplication 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteZTNAApplication
      summary: Palo Alto Networks Delete ZTNA Application
      description: Deletes a ZTNA-protected application definition.
      tags:
      - Applications
      parameters:
      - name: app_id
        in: path
        required: true
        description: Unique identifier of the ZTNA application to delete.
        schema:
          type: string
        example: '845602'
      responses:
        '204':
          description: ZTNA application deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                DeleteZtnaapplication401Example:
                  summary: Default deleteZTNAApplication 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                DeleteZtnaapplication403Example:
                  summary: Default deleteZTNAApplication 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: ZTNA application not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                DeleteZtnaapplication404Example:
                  summary: Default deleteZTNAApplication 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                DeleteZtnaapplication500Example:
                  summary: Default deleteZTNAApplication 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse_3:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Security firewall network configured traffic blocked threat.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 709c60bb-8234-4bc4-938b-d0835224c350
    ZTNAApplication:
      type: object
      properties:
        app_id:
          type: string
          description: Unique identifier of the ZTNA application.
          example: '768496'
        name:
          type: string
          description: Display name of the application.
          example: Corporate Sensor 20
        description:
          type: string
          description: Description of the application.
          example: On investigation rule violation threat monitoring.
        group_id:
          type: string
          description: Connector group ID used to access this application.
          example: '907399'
        fqdn:
          type: string
          description: Fully qualified domain name of the private application.
          example: api.acme-systems.org
        ports:
          type: array
          items:
            type: integer
          description: TCP/UDP ports accessible through ZTNA.
          example:
          - 603
          - 3
        protocols:
          type: array
          items:
            type: string
            enum:
            - TCP
            - UDP
          description: Network protocols allowed for this application.
          example:
          - TCP
        enabled:
          type: boolean
          description: Whether ZTNA access for this application is enabled.
          example: true
        created_at:
          type: string
          format: date-time
          example: '2024-05-17T06:02:30Z'
    MonitoredApplication:
      type: object
      properties:
        app_id:
          type: string
          description: Unique application identifier.
          example: '100488'
        name:
          type: string
          description: Application name.
          example: Production Firewall 97
        category:
          type: string
          description: Application category (e.g., Collaboration, Productivity, Security).
          example: custom
        type:
          type: string
          enum:
          - saas
          - internal
          description: Whether the application is a SaaS or internal application.
          example: saas
        url:
          type: string
          description: Primary URL for the application.
          example: https://vpn.acme-systems.org/a5d006
        test_count:
          type: integer
          description: Number of synthetic tests configured for this application.
          example: 241
        monitored_users:
          type: integer
          description: Number of users with active monitoring for this application.
          example: 122
        created_at:
          type: string
          format: date-time
          description: Timestamp when the application was added to monitoring.
          example: '2026-02-02T08:43:53Z'
    ZTNAApplicationRequest:
      type: object
      required:
      - name
      - group_id
      - fqdn
      properties:
        name:
          type: string
          description: Display name for the ZTNA application.
          example: Branch Agent 75
        description:
          type: string
          description: Optional description of the application.
          example: Incident suspicious firewall Security suspicious policy threat suspicious.
        group_id:
          type: string
          description: Connector group ID to use for accessing the application.
          example: '376339'
        fqdn:
          type: string
          description: Fully qualified domain name of the private application.
          example: login.test-corp.net
        ports:
          type: array
          items:
            type: integer
          description: TCP/UDP ports to expose through ZTNA.
          example:
          - 28
        protocols:
          type: array
          items:
            type: string
            enum:
            - TCP
            - UDP
          description: Network protocols to allow.
          example:
          - TCP
          - UDP
        enabled:
          type: boolean
          default: true
          description: Whether to enable ZTNA access immediately after creation.
          example: true
    Application:
      type: object
      properties:
        id:
          type: string
          description: Unique application identifier.
          example: example-id
        name:
          type: string
          description: SaaS application name (e.g., Google Drive, Microsoft SharePoint).
          example: Primary Agent 80
        type:
          type: string
          description: Application type or category.
          example: advanced
        status:
          type: string
          enum:
          - connected
          - disconnected
          - error
          description: Current connection status.
          example: connected
        asset_count:
          type: integer
          description: Number of assets scanned for this application.
          example: 752
        incident_count:
          type: integer
          description: Number of active incidents for this application.
          example: 54
        connected_at:
          type: string
          format: date-time
          description: Timestamp when the application was connected.
          example: '2025-07-22T17:44:41Z'
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Firewall incident blocked blocked firewall configured firewall.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security detected monitoring activity firewall violation activity.
            details: {}
        _request_id:
          type: string
          example: '921009'
    ErrorResponse_2:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Configured monitoring network blocked investigation applied activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 5cc3d66e-5479-4e15-bd64-849adde3cb60
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.