openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Attachments API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Attachments
  description: Email attachment retrieval operations.
paths:
  /email-incidents/{id}/attachments:
    get:
      operationId: getEmailIncidentAttachments
      summary: Palo Alto Networks Get Email Incident Attachments
      description: Returns metadata for all attachments associated with a specific email DLP incident. Includes attachment filename, content type, size, and data pattern match information for each attachment that contributed to the incident.
      tags:
      - Attachments
      parameters:
      - name: id
        in: path
        required: true
        description: Unique incident identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Email attachments returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  incident_id:
                    type: string
                    description: Identifier of the parent incident.
                  attachments:
                    type: array
                    items:
                      $ref: '#/components/schemas/EmailAttachment'
              examples:
                GetEmailIncidentAttachments200Example:
                  summary: Default getEmailIncidentAttachments 200 response
                  x-microcks-default: true
                  value:
                    incident_id: '290598'
                    attachments:
                    - filename: Corporate Policy 38
                      content_type: advanced
                      size: 438
                      has_matches: false
                      match_count: 158
                      patterns_matched:
                      - example-patterns_matched_item
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient role permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    EmailAttachment:
      type: object
      properties:
        filename:
          type: string
          description: Attachment filename.
          example: Corporate Policy 38
        content_type:
          type: string
          description: MIME content type of the attachment.
          example: advanced
        size:
          type: integer
          description: Attachment size in bytes.
          example: 438
        has_matches:
          type: boolean
          description: Whether the attachment contained data pattern matches.
          example: false
        match_count:
          type: integer
          description: Number of data pattern matches in the attachment.
          example: 158
        patterns_matched:
          type: array
          items:
            type: string
          description: Names of data patterns that matched in the attachment.
          example:
          - example-patterns_matched_item
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code or type.
          example: example-error
        message:
          type: string
          description: Human-readable error message.
          example: Policy network malware on detected configured on incident blocked violation.
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.