openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Configuration API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Configuration
  description: Candidate configuration management and job tracking.
paths:
  /config-versions/candidate:push:
    post:
      operationId: pushCandidateConfig
      summary: Palo Alto Networks Push Candidate Configuration
      description: Pushes the current candidate configuration to the running configuration, activating all staged changes across remote networks, service connections, security policies, and other configuration elements modified since the last push. The push is asynchronous and returns a job ID for tracking progress.
      tags:
      - Configuration
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                folders:
                  type: array
                  description: List of folders to push. If omitted, all folders with pending changes are pushed.
                  items:
                    type: string
                description:
                  type: string
                  description: Description of the configuration push.
            examples:
              PushCandidateConfigRequestExample:
                summary: Default pushCandidateConfig request
                x-microcks-default: true
                value:
                  folders:
                  - example-folders_item
                  description: Policy policy firewall incident threat incident firewall malware traffic threat applied incident.
      responses:
        '200':
          description: Configuration push initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    description: Whether the push was initiated successfully.
                  job_id:
                    type: string
                    description: Job identifier for tracking push operation status.
                  message:
                    type: string
              examples:
                PushCandidateConfig200Example:
                  summary: Default pushCandidateConfig 200 response
                  x-microcks-default: true
                  value:
                    success: false
                    job_id: '436513'
                    message: Monitoring incident network detected blocked traffic applied suspicious.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /jobs/{id}:
    get:
      operationId: getJobStatus
      summary: Palo Alto Networks Get Job Status
      description: Returns the current status of an asynchronous job such as a candidate configuration push. Poll this endpoint to track the progress of long-running operations.
      tags:
      - Configuration
      parameters:
      - name: id
        in: path
        required: true
        description: Job identifier returned by an asynchronous operation.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Job status returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JobStatus'
              examples:
                GetJobStatus200Example:
                  summary: Default getJobStatus 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    type: advanced
                    status: pending
                    result: FAIL
                    start_ts: '2025-09-19T19:32:25Z'
                    end_ts: '2024-08-13T06:47:25Z'
                    description: Investigation violation threat firewall monitoring suspicious.
                    details:
                    - example-details_item
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sse/config/v1/config-versions/candidate:push:
    post:
      operationId: pushCandidateConfig
      summary: Palo Alto Networks Push Candidate Configuration
      description: Pushes the candidate configuration to managed devices in the specified folders. This operation deploys all staged configuration changes to target firewalls and Prisma Access nodes. Returns a job ID that can be polled to track push operation status.
      tags:
      - Configuration
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - folders
              properties:
                folders:
                  type: array
                  items:
                    type: string
                  description: Folder names to push configuration for (e.g., Shared, Mobile Users, Remote Networks, Service Connections).
                  example: &id001
                  - Shared
                  - Mobile Users
                description:
                  type: string
                  description: Optional description for this push operation.
            examples:
              PushCandidateConfigRequestExample:
                summary: Default pushCandidateConfig request
                x-microcks-default: true
                value:
                  folders: *id001
                  description: Endpoint investigation endpoint configured suspicious network blocked traffic incident blocked.
      responses:
        '200':
          description: Configuration push job initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  job_id:
                    type: string
                    description: Job ID for tracking push status via GET /sse/config/v1/jobs/{id}.
                  message:
                    type: string
              examples:
                PushCandidateConfig200Example:
                  summary: Default pushCandidateConfig 200 response
                  x-microcks-default: true
                  value:
                    success: true
                    job_id: '603390'
                    message: Endpoint traffic endpoint alert activity blocked.
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '403':
          $ref: '#/components/responses/Forbidden_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden_2:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse_2'
    BadRequest_2:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse_2'
    Unauthorized_2:
      description: Missing or invalid authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse_2'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    JobStatus:
      type: object
      properties:
        id:
          type: string
          description: Unique job identifier.
          example: example-id
        type:
          type: string
          description: Type of asynchronous job.
          example: advanced
        status:
          type: string
          enum:
          - pending
          - running
          - completed
          - failed
          description: Current status of the job.
          example: pending
        result:
          type: string
          enum:
          - OK
          - FAIL
          description: Final result of the job once completed.
          example: FAIL
        start_ts:
          type: string
          format: date-time
          description: Timestamp when the job started.
          example: '2025-09-19T19:32:25Z'
        end_ts:
          type: string
          format: date-time
          description: Timestamp when the job completed.
          example: '2024-08-13T06:47:25Z'
        description:
          type: string
          description: Job description.
          example: Investigation violation threat firewall monitoring suspicious.
        details:
          type: array
          items:
            type: string
          description: Job status detail messages.
          example:
          - example-details_item
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Alert malware configured threat rule network malware configured on.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Threat configured alert firewall violation monitoring traffic activity.
            details: {}
          - code: example-code
            message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network.
            details: {}
        _request_id:
          type: string
          example: '980164'
    ErrorResponse_2:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security monitoring rule configured endpoint on network blocked.
            details: {}
          - code: example-code
            message: Security on on threat monitoring activity policy.
            details: {}
        _request_id:
          type: string
          description: Unique request identifier for troubleshooting.
          example: '574499'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.