openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend AttackSurfaceRules API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: AttackSurfaceRules
  description: Attack surface rule configuration and management.
paths:
  /attack_surface_rules/get_attack_surface_rules:
    post:
      operationId: getAttackSurfaceRules
      summary: Palo Alto Networks Get Attack Surface Rules
      description: Returns the configured attack surface rules. Attack surface rules define the criteria Xpanse uses to classify exposures as incidents, including service type, port, protocol, and risk classification logic. Rules can be enabled, disabled, or customized per business context.
      tags:
      - AttackSurfaceRules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder'
            examples:
              GetAttackSurfaceRulesRequestExample:
                summary: Default getAttackSurfaceRules request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: contains
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Attack surface rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      attack_surface_rules:
                        type: array
                        items:
                          $ref: '#/components/schemas/AttackSurfaceRule'
              examples:
                GetAttackSurfaceRules200Example:
                  summary: Default getAttackSurfaceRules 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 281
                      result_count: 551
                      attack_surface_rules:
                      - attack_surface_rule_id: '791314'
                        attack_surface_rule_name: Production Policy 68
                        category: standard
                        description: Monitoring activity on rule malware Security policy violation configured activity applied violation.
                        remediation_guidance: example-remediation_guidance
                        enabled_status: false
                        severity: low
                        created: 981
                        modified: 233
                        release_status: BETA
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /attack_surface_rules/update_attack_surface_rule:
    post:
      operationId: updateAttackSurfaceRule
      summary: Palo Alto Networks Update Attack Surface Rule
      description: Updates the configuration of an attack surface rule, such as enabling or disabling it, changing its severity, or modifying the scope of assets it applies to.
      tags:
      - AttackSurfaceRules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - attack_surface_rule_id
                  properties:
                    attack_surface_rule_id:
                      type: string
                      description: Unique identifier of the attack surface rule.
                    enabled_status:
                      type: string
                      enum:
                      - true
                      - false
                    severity:
                      type: string
                      enum:
                      - critical
                      - high
                      - medium
                      - low
                      - informational
                    remediation_guidance:
                      type: string
                      description: Updated remediation guidance text.
            examples:
              UpdateAttackSurfaceRuleRequestExample:
                summary: Default updateAttackSurfaceRule request
                x-microcks-default: true
                value:
                  request_data:
                    attack_surface_rule_id: '160681'
                    enabled_status: false
                    severity: informational
                    remediation_guidance: example-remediation_guidance
      responses:
        '200':
          description: Attack surface rule updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: boolean
              examples:
                UpdateAttackSurfaceRule200Example:
                  summary: Default updateAttackSurfaceRule 200 response
                  x-microcks-default: true
                  value:
                    reply: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Filter:
      type: object
      description: A filter criterion for querying Xpanse resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on.
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          example: contains
        value:
          description: Filter value (string, integer, or array for "in" operator).
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    AttackSurfaceRule:
      type: object
      description: An attack surface rule defining criteria for classifying internet exposures as incidents.
      properties:
        attack_surface_rule_id:
          type: string
          example: '791314'
        attack_surface_rule_name:
          type: string
          example: Production Policy 68
        category:
          type: string
          description: Rule category (e.g., Unencrypted, Misconfigured, Unauthorized).
          example: standard
        description:
          type: string
          example: Monitoring activity on rule malware Security policy violation configured activity applied violation.
        remediation_guidance:
          type: string
          example: example-remediation_guidance
        enabled_status:
          type: string
          enum:
          - true
          - false
          example: false
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - informational
          example: low
        created:
          type: integer
          example: 981
        modified:
          type: integer
          example: 233
        release_status:
          type: string
          enum:
          - GA
          - BETA
          example: BETA
    ErrorResponse:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 849
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 931
            err_msg: example-err_msg
            err_extra: example-err_extra
    SortOrder:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          example: asc
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication headers.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request body or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.