openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend BPA Requests API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: BPA Requests
  description: Best Practice Assessment request submission and status tracking.
paths:
  /requests:
    post:
      operationId: submitBPARequest
      summary: Palo Alto Networks Submit BPA Request
      description: Submits a Best Practice Assessment request for a specific NGFW device. The request requires the device serial number, PAN-OS version, and optional device information. The assessment runs asynchronously; use the returned request ID to check status and retrieve the report when complete.
      tags:
      - BPA Requests
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BPARequest'
            examples:
              SubmitBparequestRequestExample:
                summary: Default submitBPARequest request
                x-microcks-default: true
                value:
                  serial_number: 4B89BF130877
                  version: 9.6.8
                  device_info:
                    hostname: host-f367
                    model: VM-300
                    deployment_type: vm
      responses:
        '201':
          description: BPA request submitted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BPARequestStatus'
              examples:
                SubmitBparequest201Example:
                  summary: Default submitBPARequest 201 response
                  x-microcks-default: true
                  value:
                    request_id: f629a7fb-33c3-4361-a3f4-c438e2f4f747
                    serial_number: 94C0577F8429
                    status: processing
                    report_id: '336271'
                    error_message: example-error_message
                    submitted_at: '2025-11-24T06:05:16Z'
                    completed_at: '2024-08-27T07:28:12Z'
        '400':
          description: Invalid request body or unsupported PAN-OS version.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                SubmitBparequest400Example:
                  summary: Default submitBPARequest 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                SubmitBparequest401Example:
                  summary: Default submitBPARequest 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '403':
          description: Insufficient permissions or device not registered to this tenant.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                SubmitBparequest403Example:
                  summary: Default submitBPARequest 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '409':
          description: A BPA request is already in progress for this device.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                SubmitBparequest409Example:
                  summary: Default submitBPARequest 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                SubmitBparequest500Example:
                  summary: Default submitBPARequest 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /requests/{request_id}:
    get:
      operationId: getBPARequestStatus
      summary: Palo Alto Networks Check BPA Request Status
      description: Returns the current processing status of a submitted BPA request. When the status is completed, the response includes the report ID which can be used to retrieve the full assessment report. Request records are retained for 30 days after completion.
      tags:
      - BPA Requests
      parameters:
      - name: request_id
        in: path
        required: true
        description: Unique identifier of the BPA request.
        schema:
          type: string
        example: bd9572c6-1b76-43a0-aa1c-3157a63cc89d
      responses:
        '200':
          description: BPA request status returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BPARequestStatus'
              examples:
                GetBparequestStatus200Example:
                  summary: Default getBPARequestStatus 200 response
                  x-microcks-default: true
                  value:
                    request_id: f629a7fb-33c3-4361-a3f4-c438e2f4f747
                    serial_number: 94C0577F8429
                    status: processing
                    report_id: '336271'
                    error_message: example-error_message
                    submitted_at: '2025-11-24T06:05:16Z'
                    completed_at: '2024-08-27T07:28:12Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBparequestStatus401Example:
                  summary: Default getBPARequestStatus 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBparequestStatus403Example:
                  summary: Default getBPARequestStatus 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '404':
          description: BPA request not found or expired.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBparequestStatus404Example:
                  summary: Default getBPARequestStatus 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBparequestStatus500Example:
                  summary: Default getBPARequestStatus 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    BPARequest:
      type: object
      required:
      - serial_number
      - version
      properties:
        serial_number:
          type: string
          description: Device serial number of the NGFW to assess.
          example: 4B89BF130877
        version:
          type: string
          description: PAN-OS software version running on the device (e.g., 11.1.2).
          pattern: ^\d+\.\d+(\.\d+)?(-h\d+)?$
          example: 9.6.8
        device_info:
          type: object
          description: Optional supplementary device information.
          properties:
            hostname:
              type: string
              description: Device hostname.
              example: host-d228
            model:
              type: string
              description: Device model (e.g., PA-5450, PA-440).
              example: VM-300
            deployment_type:
              type: string
              enum:
              - physical
              - vm
              - container
              description: Device deployment type.
              example: vm
          example:
            hostname: host-f367
            model: VM-300
            deployment_type: vm
    BPARequestStatus:
      type: object
      properties:
        request_id:
          type: string
          description: Unique identifier of the BPA request.
          example: f629a7fb-33c3-4361-a3f4-c438e2f4f747
        serial_number:
          type: string
          description: Device serial number for which the assessment was submitted.
          example: 94C0577F8429
        status:
          type: string
          enum:
          - pending
          - processing
          - completed
          - failed
          description: Current processing status of the request.
          example: processing
        report_id:
          type: string
          description: Report identifier available when status is completed. Use with GET /reports/{report_id} to retrieve the full report.
          example: '336271'
        error_message:
          type: string
          description: Error description when status is failed.
          example: example-error_message
        submitted_at:
          type: string
          format: date-time
          description: Timestamp when the request was submitted.
          example: '2025-11-24T06:05:16Z'
        completed_at:
          type: string
          format: date-time
          description: Timestamp when processing completed.
          example: '2024-08-27T07:28:12Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Violation alert configured endpoint policy policy policy.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: e0526af9-36bf-48c4-80c9-db1fb17c933f
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.