openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend ApplicationScores API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: ApplicationScores
  description: Application experience score monitoring providing aggregated performance ratings for SaaS and internal applications.
paths:
  /mt/monitor/adem/v1/applications/scores:
    get:
      operationId: getApplicationScores
      summary: Palo Alto Networks Get Application Experience Scores
      description: Returns application experience scores representing the end-to-end quality of user interactions with monitored applications. Scores range from 0 to 100 with higher values indicating better experience. Results can be filtered by application, user, site, and time range.
      tags:
      - ApplicationScores
      parameters:
      - name: start_time
        in: query
        description: Start of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2024-04-20T16:09:54Z'
      - name: end_time
        in: query
        description: End of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2025-04-09T17:12:13Z'
      - name: time_range
        in: query
        description: Relative time range shorthand (e.g., last_1_hour, last_24_hours).
        schema:
          type: string
          enum:
          - last_1_hour
          - last_4_hours
          - last_24_hours
          - last_7_days
          - last_30_days
        example: last_30_days
      - name: app_id
        in: query
        description: Filter by monitored application identifier.
        schema:
          type: string
        example: '241281'
      - name: user_id
        in: query
        description: Filter by user email address or identifier.
        schema:
          type: string
        example: '599085'
      - name: site_name
        in: query
        description: Filter by site name.
        schema:
          type: string
        example: Production Policy 68
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      responses:
        '200':
          description: Application scores returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApplicationScore'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                GetApplicationScores200Example:
                  summary: Default getApplicationScores 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - timestamp: '2026-08-24T01:11:50Z'
                      app_id: '983491'
                      application: web-browsing
                      user_id: '171053'
                      site_name: Corporate Firewall 32
                      overall_score: 64
                      endpoint_score: 37
                      network_score: 4
                      application_score: 99
                      latency_ms: 16.24
                      packet_loss_pct: 96.61
                      jitter_ms: 59.22
                      sample_count: 162
                    total: 761
                    offset: 140
                    limit: 970
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ApplicationScore:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
          description: Time bucket for the aggregated score.
          example: '2026-08-24T01:11:50Z'
        app_id:
          type: string
          description: Monitored application identifier.
          example: '983491'
        application:
          type: string
          description: Name of the monitored application.
          example: web-browsing
        user_id:
          type: string
          description: User identifier if filtering by user.
          example: '171053'
        site_name:
          type: string
          description: Site name if filtering by site.
          example: Corporate Firewall 32
        overall_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Overall experience score from 0 to 100.
          example: 64
        endpoint_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Endpoint health score.
          example: 37
        network_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Network path score.
          example: 4
        application_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Application responsiveness score.
          example: 99
        latency_ms:
          type: number
          description: Average round-trip latency in milliseconds.
          example: 16.24
        packet_loss_pct:
          type: number
          description: Packet loss percentage.
          example: 96.61
        jitter_ms:
          type: number
          description: Latency variation in milliseconds.
          example: 59.22
        sample_count:
          type: integer
          description: Number of measurement samples in this time bucket.
          example: 162
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Firewall incident blocked blocked firewall configured firewall.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security detected monitoring activity firewall violation activity.
            details: {}
        _request_id:
          type: string
          example: '921009'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.