openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend CloudAccounts API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: CloudAccounts
  description: Cloud account onboarding and management.
paths:
  /cloud:
    get:
      operationId: listCloudAccounts
      summary: Palo Alto Networks List Cloud Accounts
      description: Returns a list of all cloud accounts onboarded to Prisma Cloud for security monitoring.
      tags:
      - CloudAccounts
      responses:
        '200':
          description: Cloud accounts returned successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CloudAccount'
              examples:
                ListCloudAccounts200Example:
                  summary: Default listCloudAccounts 200 response
                  x-microcks-default: true
                  value:
                  - accountId: '166602'
                    name: Branch Policy 85
                    cloudType: aws
                    enabled: true
                    numberOfPolicies: 638
                    lastModifiedTs: 347
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /cloud/{cloudType}:
    post:
      operationId: addCloudAccount
      summary: Palo Alto Networks Add a Cloud Account
      description: Onboards a cloud account (AWS, Azure, GCP, or OCI) for security monitoring. Requires appropriate cloud credentials and permissions.
      tags:
      - CloudAccounts
      parameters:
      - name: cloudType
        in: path
        required: true
        description: Cloud provider type to onboard.
        schema:
          type: string
          enum:
          - aws
          - azure
          - gcp
          - oci
        example: azure
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - accountId
              - name
              properties:
                accountId:
                  type: string
                  description: Cloud provider account identifier.
                enabled:
                  type: boolean
                  default: true
                  description: Whether monitoring is enabled for this account.
                name:
                  type: string
                  description: Display name for the account.
                groupIds:
                  type: array
                  items:
                    type: string
                  description: Account group IDs to associate.
            examples:
              AddCloudAccountRequestExample:
                summary: Default addCloudAccount request
                x-microcks-default: true
                value:
                  accountId: '207427'
                  enabled: true
                  name: Primary Sensor 81
                  groupIds:
                  - example-groupIds_item
                  - example-groupIds_item
      responses:
        '200':
          description: Cloud account onboarded successfully.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /cloud/{cloudType}/{id}:
    delete:
      operationId: removeCloudAccount
      summary: Palo Alto Networks Remove a Cloud Account
      description: Removes a cloud account from Prisma Cloud monitoring. All associated alerts and data are retained for historical analysis.
      tags:
      - CloudAccounts
      parameters:
      - name: cloudType
        in: path
        required: true
        description: Cloud provider type.
        schema:
          type: string
          enum:
          - aws
          - azure
          - gcp
          - oci
        example: azure
      - name: id
        in: path
        required: true
        description: Cloud account identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Cloud account removed successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired JWT token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    CloudAccount:
      type: object
      properties:
        accountId:
          type: string
          description: Cloud provider account identifier.
          example: '166602'
        name:
          type: string
          description: Display name of the account.
          example: Branch Policy 85
        cloudType:
          type: string
          enum:
          - aws
          - azure
          - gcp
          - oci
          description: Cloud provider type.
          example: aws
        enabled:
          type: boolean
          description: Whether monitoring is enabled.
          example: true
        numberOfPolicies:
          type: integer
          description: Number of policies applied to this account.
          example: 638
        lastModifiedTs:
          type: integer
          description: Epoch timestamp of last modification.
          example: 347
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 747
        message:
          type: string
          description: Human-readable error message.
          example: Traffic violation investigation monitoring policy incident applied threat monitoring alert.
        error:
          type: string
          description: Error code.
          example: example-error
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.