openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Connectors API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Connectors
  description: ZTNA connector lifecycle management.
paths:
  /v2/connectors:
    get:
      operationId: listConnectors
      summary: Palo Alto Networks List ZTNA Connectors
      description: Returns the list of ZTNA connectors configured for the tenant. Connectors are software agents deployed in private network environments. Each connector entry includes its current health status, associated connector group, software version, and connected application count.
      tags:
      - Connectors
      parameters:
      - name: group_id
        in: query
        description: Filter connectors by connector group ID.
        schema:
          type: string
        example: '716603'
      - name: status
        in: query
        description: Filter connectors by health status.
        schema:
          type: string
          enum:
          - connected
          - disconnected
          - upgrading
          - error
        example: error
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of connectors to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Connectors returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Connector'
              examples:
                ListConnectors200Example:
                  summary: Default listConnectors 200 response
                  x-microcks-default: true
                  value:
                    total: 660
                    offset: 883
                    limit: 838
                    items:
                    - connector_id: '794298'
                      name: Production Gateway 37
                      group_id: '577658'
                      status: connected
                      version: 10.4.9
                      hostname: host-51b1
                      ip_address: 10.28.192.109
                      region: eu-west-1
                      last_seen_at: '2024-07-11T13:58:11Z'
                      created_at: '2025-10-12T04:55:41Z'
                    - connector_id: '794298'
                      name: Production Gateway 37
                      group_id: '577658'
                      status: connected
                      version: 10.4.9
                      hostname: host-51b1
                      ip_address: 10.28.192.109
                      region: eu-west-1
                      last_seen_at: '2024-07-11T13:58:11Z'
                      created_at: '2025-10-12T04:55:41Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors400Example:
                  summary: Default listConnectors 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors401Example:
                  summary: Default listConnectors 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors403Example:
                  summary: Default listConnectors 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors500Example:
                  summary: Default listConnectors 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createConnector
      summary: Palo Alto Networks Create ZTNA Connector
      description: Creates a new ZTNA connector configuration and generates the installation token needed to deploy the connector software in a private network environment. The connector must be assigned to an existing connector group.
      tags:
      - Connectors
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectorRequest'
            examples:
              CreateConnectorRequestExample:
                summary: Default createConnector request
                x-microcks-default: true
                value:
                  name: Production Sensor 37
                  group_id: '814975'
                  description: Blocked suspicious investigation malware alert rule policy.
      responses:
        '201':
          description: Connector created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connector'
              examples:
                CreateConnector201Example:
                  summary: Default createConnector 201 response
                  x-microcks-default: true
                  value:
                    connector_id: '794298'
                    name: Production Gateway 37
                    group_id: '577658'
                    status: connected
                    version: 10.4.9
                    hostname: host-51b1
                    ip_address: 10.28.192.109
                    region: eu-west-1
                    last_seen_at: '2024-07-11T13:58:11Z'
                    created_at: '2025-10-12T04:55:41Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector400Example:
                  summary: Default createConnector 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector401Example:
                  summary: Default createConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector403Example:
                  summary: Default createConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector500Example:
                  summary: Default createConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/connectors/{connector_id}:
    get:
      operationId: getConnector
      summary: Palo Alto Networks Get ZTNA Connector
      description: Returns full details for a specific ZTNA connector by ID.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector.
        schema:
          type: string
        example: '975993'
      responses:
        '200':
          description: Connector details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connector'
              examples:
                GetConnector200Example:
                  summary: Default getConnector 200 response
                  x-microcks-default: true
                  value:
                    connector_id: '794298'
                    name: Production Gateway 37
                    group_id: '577658'
                    status: connected
                    version: 10.4.9
                    hostname: host-51b1
                    ip_address: 10.28.192.109
                    region: eu-west-1
                    last_seen_at: '2024-07-11T13:58:11Z'
                    created_at: '2025-10-12T04:55:41Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector401Example:
                  summary: Default getConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector403Example:
                  summary: Default getConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector404Example:
                  summary: Default getConnector 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector500Example:
                  summary: Default getConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateConnector
      summary: Palo Alto Networks Update ZTNA Connector
      description: Updates the configuration of an existing ZTNA connector.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector to update.
        schema:
          type: string
        example: '321702'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectorRequest'
            examples:
              UpdateConnectorRequestExample:
                summary: Default updateConnector request
                x-microcks-default: true
                value:
                  name: Production Sensor 37
                  group_id: '814975'
                  description: Blocked suspicious investigation malware alert rule policy.
      responses:
        '200':
          description: Connector updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connector'
              examples:
                UpdateConnector200Example:
                  summary: Default updateConnector 200 response
                  x-microcks-default: true
                  value:
                    connector_id: '794298'
                    name: Production Gateway 37
                    group_id: '577658'
                    status: connected
                    version: 10.4.9
                    hostname: host-51b1
                    ip_address: 10.28.192.109
                    region: eu-west-1
                    last_seen_at: '2024-07-11T13:58:11Z'
                    created_at: '2025-10-12T04:55:41Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector400Example:
                  summary: Default updateConnector 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector401Example:
                  summary: Default updateConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector403Example:
                  summary: Default updateConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector404Example:
                  summary: Default updateConnector 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector500Example:
                  summary: Default updateConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteConnector
      summary: Palo Alto Networks Delete ZTNA Connector
      description: Deletes a ZTNA connector. The connector must be in a disconnected state before deletion. Any applications relying on this connector must be reassigned first.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector to delete.
        schema:
          type: string
        example: '352549'
      responses:
        '204':
          description: Connector deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector401Example:
                  summary: Default deleteConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector403Example:
                  summary: Default deleteConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector404Example:
                  summary: Default deleteConnector 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector500Example:
                  summary: Default deleteConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/connectors/{connector_id}/upgrade:
    post:
      operationId: scheduleConnectorUpgrade
      summary: Palo Alto Networks Schedule Connector Upgrade
      description: Schedules a software upgrade for a specific ZTNA connector. The upgrade can be scheduled for immediate execution or for a specified maintenance window. During the upgrade, the connector briefly disconnects; traffic is routed through other connectors in the same group if available.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector to upgrade.
        schema:
          type: string
        example: '287403'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                scheduled_at:
                  type: string
                  format: date-time
                  description: Scheduled time for the upgrade. If omitted, the upgrade starts immediately.
                target_version:
                  type: string
                  description: Target software version. If omitted, upgrades to the latest available version.
            examples:
              ScheduleConnectorUpgradeRequestExample:
                summary: Default scheduleConnectorUpgrade request
                x-microcks-default: true
                value:
                  scheduled_at: '2026-05-12T04:07:50Z'
                  target_version: 10.6.9
      responses:
        '200':
          description: Upgrade scheduled successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  connector_id:
                    type: string
                  upgrade_status:
                    type: string
                    enum:
                    - scheduled
                    - in_progress
                  scheduled_at:
                    type: string
                    format: date-time
                  target_version:
                    type: string
              examples:
                ScheduleConnectorUpgrade200Example:
                  summary: Default scheduleConnectorUpgrade 200 response
                  x-microcks-default: true
                  value:
                    connector_id: '427273'
                    upgrade_status: scheduled
                    scheduled_at: '2024-10-25T18:45:30Z'
                    target_version: 3.9.9
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade400Example:
                  summary: Default scheduleConnectorUpgrade 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade401Example:
                  summary: Default scheduleConnectorUpgrade 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade403Example:
                  summary: Default scheduleConnectorUpgrade 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade404Example:
                  summary: Default scheduleConnectorUpgrade 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade500Example:
                  summary: Default scheduleConnectorUpgrade 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Connector:
      type: object
      properties:
        connector_id:
          type: string
          description: Unique identifier of the connector.
          example: '794298'
        name:
          type: string
          description: Display name of the connector.
          example: Production Gateway 37
        group_id:
          type: string
          description: ID of the connector group this connector belongs to.
          example: '577658'
        status:
          type: string
          enum:
          - connected
          - disconnected
          - upgrading
          - error
          description: Current health status of the connector.
          example: connected
        version:
          type: string
          description: Installed connector software version.
          example: 10.4.9
        hostname:
          type: string
          description: Hostname of the system where the connector is installed.
          example: host-51b1
        ip_address:
          type: string
          description: IP address of the connector host.
          example: 10.28.192.109
        region:
          type: string
          description: Geographic region where the connector is deployed.
          example: eu-west-1
        last_seen_at:
          type: string
          format: date-time
          description: Timestamp of the connector's most recent heartbeat.
          example: '2024-07-11T13:58:11Z'
        created_at:
          type: string
          format: date-time
          example: '2025-10-12T04:55:41Z'
    ConnectorRequest:
      type: object
      required:
      - name
      - group_id
      properties:
        name:
          type: string
          description: Display name for the connector.
          example: Production Sensor 37
        group_id:
          type: string
          description: ID of the connector group to assign the connector to.
          example: '814975'
        description:
          type: string
          description: Optional description of the connector's purpose or location.
          example: Blocked suspicious investigation malware alert rule policy.
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Security firewall network configured traffic blocked threat.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 709c60bb-8234-4bc4-938b-d0835224c350
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.