openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend DataStores API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: DataStores
  description: Data store inventory and discovery operations.
paths:
  /dspm/api/v1/data-stores:
    get:
      operationId: listDataStores
      summary: Palo Alto Networks List Data Stores Inventory
      description: Returns a list of all cloud data stores discovered by Prisma Cloud DSPM. Includes relational databases, NoSQL databases, object storage, file shares, data warehouses, and other cloud-native data services. Supports filtering by cloud provider, region, service type, and risk level.
      tags:
      - DataStores
      parameters:
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 25
        example: 25
      - name: cloudProvider
        in: query
        description: Filter by cloud provider.
        schema:
          type: string
          enum:
          - aws
          - azure
          - gcp
        example: gcp
      - name: region
        in: query
        description: Filter by cloud region.
        schema:
          type: string
        example: eu-west-1
      - name: serviceType
        in: query
        description: Filter by data store service type.
        schema:
          type: string
          enum:
          - relationalDatabase
          - noSqlDatabase
          - objectStorage
          - fileShare
          - dataWarehouse
          - dataLake
          - cache
          - messageQueue
        example: objectStorage
      - name: riskLevel
        in: query
        description: Filter by assigned risk level.
        schema:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
        example: critical
      - name: hasSensitiveData
        in: query
        description: Filter to only data stores containing classified sensitive data.
        schema:
          type: boolean
        example: false
      - name: search
        in: query
        description: Search term to filter by data store name or identifier.
        schema:
          type: string
        example: example-search
      - name: sortBy
        in: query
        description: Field to sort results by.
        schema:
          type: string
          enum:
          - name
          - riskLevel
          - sensitiveDataCount
          - discoveredAt
        example: riskLevel
      - name: sortOrder
        in: query
        description: Sort order direction.
        schema:
          type: string
          enum:
          - asc
          - desc
          default: desc
        example: desc
      responses:
        '200':
          description: Data stores returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  totalCount:
                    type: integer
                    description: Total number of discovered data stores matching filters.
                  dataStores:
                    type: array
                    items:
                      $ref: '#/components/schemas/DataStore'
              examples:
                ListDataStores200Example:
                  summary: Default listDataStores 200 response
                  x-microcks-default: true
                  value:
                    totalCount: 423
                    dataStores:
                    - id: example-id
                      name: Branch Sensor 82
                      cloudProvider: gcp
                      cloudAccountId: '191154'
                      region: us-west-2
                      serviceType: fileShare
                      serviceName: Corporate Agent 94
                      encryptionEnabled: true
                      isPubliclyAccessible: true
                      riskLevel: critical
                      sensitiveDataCount: 866
                      classificationLabels:
                      - example-classificationLabels_item
                      - example-classificationLabels_item
                      dataAssetCount: 315
                      discoveredAt: '2026-05-16T02:34:09Z'
                      lastScannedAt: '2026-06-05T18:50:04Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired JWT token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 177
        message:
          type: string
          description: Human-readable error message.
          example: Suspicious traffic configured monitoring malware endpoint applied.
        error:
          type: string
          description: Error code.
          example: example-error
    DataStore:
      type: object
      properties:
        id:
          type: string
          description: Unique data store identifier in Prisma Cloud.
          example: example-id
        name:
          type: string
          description: Name of the data store as it appears in the cloud provider.
          example: Branch Sensor 82
        cloudProvider:
          type: string
          enum:
          - aws
          - azure
          - gcp
          description: Cloud provider where the data store is hosted.
          example: gcp
        cloudAccountId:
          type: string
          description: Cloud account ID that owns the data store.
          example: '191154'
        region:
          type: string
          description: Cloud region where the data store is located.
          example: us-west-2
        serviceType:
          type: string
          enum:
          - relationalDatabase
          - noSqlDatabase
          - objectStorage
          - fileShare
          - dataWarehouse
          - dataLake
          - cache
          - messageQueue
          description: Category of the data store service.
          example: fileShare
        serviceName:
          type: string
          description: Specific cloud service name (e.g., Amazon S3, Amazon RDS).
          example: Corporate Agent 94
        encryptionEnabled:
          type: boolean
          description: Whether encryption at rest is enabled.
          example: true
        isPubliclyAccessible:
          type: boolean
          description: Whether the data store is accessible from the public internet.
          example: true
        riskLevel:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          description: Overall risk level computed from data sensitivity and security posture.
          example: critical
        sensitiveDataCount:
          type: integer
          description: Number of sensitive data assets found in this data store.
          example: 866
        classificationLabels:
          type: array
          items:
            type: string
          description: Distinct classification labels found in the data store.
          example:
          - example-classificationLabels_item
          - example-classificationLabels_item
        dataAssetCount:
          type: integer
          description: Total number of data assets discovered in this data store.
          example: 315
        discoveredAt:
          type: string
          format: date-time
          description: Timestamp when the data store was first discovered by DSPM.
          example: '2026-05-16T02:34:09Z'
        lastScannedAt:
          type: string
          format: date-time
          description: Timestamp of the most recent data classification scan.
          example: '2026-06-05T18:50:04Z'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.