openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Email Destinations API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Email Destinations
  description: Email forwarding destination management.
paths:
  /log-forwarding-profiles/{profile_id}/destinations/email:
    get:
      operationId: listEmailDestinations
      summary: Palo Alto Networks List Email Destinations
      description: Returns the email destinations configured for a log forwarding profile.
      tags:
      - Email Destinations
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '684382'
      responses:
        '200':
          description: Email destinations returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/EmailDestination'
              examples:
                ListEmailDestinations200Example:
                  summary: Default listEmailDestinations 200 response
                  x-microcks-default: true
                  value:
                    total: 692
                    items:
                    - destination_id: '123266'
                      name: Production Sensor 97
                      gateway: example-gateway
                      from: security-ops@example.com
                      to: security-ops@example.com
                      and_also_to: soc-admin@example.com
                      enabled: true
                      created_at: '2026-02-21T20:59:59Z'
                    - destination_id: '123266'
                      name: Production Sensor 97
                      gateway: example-gateway
                      from: security-ops@example.com
                      to: security-ops@example.com
                      and_also_to: soc-admin@example.com
                      enabled: true
                      created_at: '2026-02-21T20:59:59Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListEmailDestinations401Example:
                  summary: Default listEmailDestinations 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListEmailDestinations403Example:
                  summary: Default listEmailDestinations 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListEmailDestinations404Example:
                  summary: Default listEmailDestinations 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListEmailDestinations500Example:
                  summary: Default listEmailDestinations 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createEmailDestination
      summary: Palo Alto Networks Create Email Destination
      description: Adds an email destination to a log forwarding profile.
      tags:
      - Email Destinations
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '708543'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailDestinationRequest'
            examples:
              CreateEmailDestinationRequestExample:
                summary: Default createEmailDestination request
                x-microcks-default: true
                value:
                  name: Production Firewall 78
                  gateway: example-gateway
                  from: jsmith@example.com
                  to: jane.doe@example.com
                  and_also_to: soc-admin@example.com
                  enabled: true
      responses:
        '201':
          description: Email destination created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailDestination'
              examples:
                CreateEmailDestination201Example:
                  summary: Default createEmailDestination 201 response
                  x-microcks-default: true
                  value:
                    destination_id: '123266'
                    name: Production Sensor 97
                    gateway: example-gateway
                    from: security-ops@example.com
                    to: security-ops@example.com
                    and_also_to: soc-admin@example.com
                    enabled: true
                    created_at: '2026-02-21T20:59:59Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateEmailDestination400Example:
                  summary: Default createEmailDestination 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateEmailDestination401Example:
                  summary: Default createEmailDestination 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateEmailDestination403Example:
                  summary: Default createEmailDestination 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateEmailDestination404Example:
                  summary: Default createEmailDestination 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateEmailDestination500Example:
                  summary: Default createEmailDestination 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    EmailDestination:
      type: object
      properties:
        destination_id:
          type: string
          description: Unique identifier of the email destination.
          example: '123266'
        name:
          type: string
          description: Display name of the destination.
          example: Production Sensor 97
        gateway:
          type: string
          description: SMTP server hostname.
          example: example-gateway
        from:
          type: string
          format: email
          description: Sender email address.
          example: security-ops@example.com
        to:
          type: string
          format: email
          description: Recipient email address.
          example: security-ops@example.com
        and_also_to:
          type: string
          format: email
          description: Additional recipient email address.
          example: soc-admin@example.com
        enabled:
          type: boolean
          example: true
        created_at:
          type: string
          format: date-time
          example: '2026-02-21T20:59:59Z'
    EmailDestinationRequest:
      type: object
      required:
      - name
      - gateway
      - from
      - to
      properties:
        name:
          type: string
          description: Display name for this email destination.
          example: Production Firewall 78
        gateway:
          type: string
          description: SMTP server hostname or IP address.
          example: example-gateway
        from:
          type: string
          format: email
          description: Sender email address.
          example: jsmith@example.com
        to:
          type: string
          format: email
          description: Primary recipient email address.
          example: jane.doe@example.com
        and_also_to:
          type: string
          format: email
          description: Additional recipient email address.
          example: soc-admin@example.com
        enabled:
          type: boolean
          default: true
          example: true
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 59fcc104-7100-494b-b0c4-09f9dcc477d9
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.