openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend DataAssets API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: DataAssets
  description: Data asset discovery and inventory operations.
paths:
  /dspm/api/v1/data-assets:
    get:
      operationId: listDataAssets
      summary: Palo Alto Networks List Data Assets
      description: Returns a list of individual data assets discovered within cloud data stores. Data assets represent granular data objects such as database tables, columns containing sensitive data, S3 object prefixes, and file share directories. Each asset includes its classification labels and sensitivity level.
      tags:
      - DataAssets
      parameters:
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 25
        example: 25
      - name: dataStoreId
        in: query
        description: Filter assets by parent data store ID.
        schema:
          type: string
        example: '459046'
      - name: classificationLabel
        in: query
        description: Filter by classification label (e.g., PII, PHI, PCI).
        schema:
          type: string
        example: example-classificationLabel
      - name: sensitivityLevel
        in: query
        description: Filter by sensitivity level.
        schema:
          type: string
          enum:
          - public
          - internal
          - confidential
          - restricted
        example: restricted
      - name: search
        in: query
        description: Search term to filter by asset name or path.
        schema:
          type: string
        example: example-search
      - name: sortBy
        in: query
        description: Field to sort results by.
        schema:
          type: string
          enum:
          - name
          - sensitivityLevel
          - discoveredAt
        example: sensitivityLevel
      - name: sortOrder
        in: query
        description: Sort order direction.
        schema:
          type: string
          enum:
          - asc
          - desc
          default: desc
        example: desc
      responses:
        '200':
          description: Data assets returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  totalCount:
                    type: integer
                    description: Total number of data assets matching filters.
                  dataAssets:
                    type: array
                    items:
                      $ref: '#/components/schemas/DataAsset'
              examples:
                ListDataAssets200Example:
                  summary: Default listDataAssets 200 response
                  x-microcks-default: true
                  value:
                    totalCount: 416
                    dataAssets:
                    - id: example-id
                      dataStoreId: '875945'
                      dataStoreName: Corporate Gateway 15
                      name: Branch Agent 83
                      assetType: file
                      path: /api/v1/2a87d6
                      classificationLabels: &id001
                      - example-classificationLabels_item
                      sensitivityLevel: internal
                      sampleFindings: &id002
                      - classificationLabel: example-classificationLabel
                        pattern: example-pattern
                        count: 445
                        sampleValue: example-sampleValue
                      recordCount: 706
                      discoveredAt: '2026-12-08T04:17:43Z'
                      lastScannedAt: '2024-11-10T12:02:32Z'
                    - id: example-id
                      dataStoreId: '875945'
                      dataStoreName: Corporate Gateway 15
                      name: Branch Agent 83
                      assetType: file
                      path: /api/v1/2a87d6
                      classificationLabels: *id001
                      sensitivityLevel: internal
                      sampleFindings: *id002
                      recordCount: 706
                      discoveredAt: '2026-12-08T04:17:43Z'
                      lastScannedAt: '2024-11-10T12:02:32Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /dspm/api/v1/data-assets/{id}:
    get:
      operationId: getDataAsset
      summary: Palo Alto Networks Get Data Asset Details
      description: Returns detailed information about a specific data asset including its full classification summary, sample findings, associated data store details, and risk posture.
      tags:
      - DataAssets
      parameters:
      - name: id
        in: path
        required: true
        description: Unique data asset identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Data asset details returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataAsset'
              examples:
                GetDataAsset200Example:
                  summary: Default getDataAsset 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    dataStoreId: '875945'
                    dataStoreName: Corporate Gateway 15
                    name: Branch Agent 83
                    assetType: file
                    path: /api/v1/2a87d6
                    classificationLabels:
                    - example-classificationLabels_item
                    sensitivityLevel: internal
                    sampleFindings:
                    - classificationLabel: example-classificationLabel
                      pattern: example-pattern
                      count: 445
                      sampleValue: example-sampleValue
                    recordCount: 706
                    discoveredAt: '2026-12-08T04:17:43Z'
                    lastScannedAt: '2024-11-10T12:02:32Z'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    DataAsset:
      type: object
      properties:
        id:
          type: string
          description: Unique data asset identifier.
          example: example-id
        dataStoreId:
          type: string
          description: Parent data store identifier.
          example: '875945'
        dataStoreName:
          type: string
          description: Name of the parent data store.
          example: Corporate Gateway 15
        name:
          type: string
          description: Name of the data asset (e.g., table name, column name, object prefix, directory name).
          example: Branch Agent 83
        assetType:
          type: string
          enum:
          - table
          - column
          - objectPrefix
          - directory
          - file
          - collection
          - index
          - schema
          description: Type of data asset.
          example: file
        path:
          type: string
          description: Full path to the data asset within the data store.
          example: /api/v1/2a87d6
        classificationLabels:
          type: array
          items:
            type: string
          description: Classification labels applied to this data asset.
          example:
          - example-classificationLabels_item
        sensitivityLevel:
          type: string
          enum:
          - public
          - internal
          - confidential
          - restricted
          description: Sensitivity level based on the most sensitive classification.
          example: internal
        sampleFindings:
          type: array
          items:
            type: object
            properties:
              classificationLabel:
                type: string
                description: Classification label matched.
                example: example-classificationLabel
              pattern:
                type: string
                description: Pattern description.
                example: example-pattern
              count:
                type: integer
                description: Approximate number of matching records.
                example: 168
              sampleValue:
                type: string
                description: Masked sample value showing the pattern match.
                example: example-sampleValue
          description: Sample data patterns found during classification.
          example:
          - classificationLabel: example-classificationLabel
            pattern: example-pattern
            count: 445
            sampleValue: example-sampleValue
        recordCount:
          type: integer
          description: Approximate number of records in this data asset.
          example: 706
        discoveredAt:
          type: string
          format: date-time
          description: Timestamp when the data asset was first discovered.
          example: '2026-12-08T04:17:43Z'
        lastScannedAt:
          type: string
          format: date-time
          description: Timestamp of the most recent classification scan.
          example: '2024-11-10T12:02:32Z'
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 177
        message:
          type: string
          description: Human-readable error message.
          example: Suspicious traffic configured monitoring malware endpoint applied.
        error:
          type: string
          description: Error code.
          example: example-error
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired JWT token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.