openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Errors API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Errors
  description: Code security errors and policy violations by branch.
paths:
  /errors/branch:
    get:
      operationId: getErrorsByBranch
      summary: Palo Alto Networks Get Errors by Branch
      description: Returns code security errors (policy violations, misconfigurations, and vulnerabilities) for a specific repository branch. Each error includes the Checkov policy ID, severity, resource name, and the file location where the issue was detected.
      tags:
      - Errors
      parameters:
      - name: repositoryId
        in: query
        required: true
        description: Repository identifier to retrieve errors for.
        schema:
          type: string
        example: '319189'
      - name: branch
        in: query
        description: Branch name to retrieve errors for. Defaults to the default branch.
        schema:
          type: string
        example: example-branch
      - name: severity
        in: query
        description: Filter errors by severity level.
        schema:
          type: string
          enum:
          - CRITICAL
          - HIGH
          - MEDIUM
          - LOW
          - INFO
        example: CRITICAL
      - name: errorType
        in: query
        description: Filter by error category.
        schema:
          type: string
          enum:
          - iac
          - sca
          - secrets
          - cicd
        example: sca
      - name: status
        in: query
        description: Filter by error status.
        schema:
          type: string
          enum:
          - OPEN
          - SUPPRESSED
          - FIXED
        example: SUPPRESSED
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 25
        example: 25
      responses:
        '200':
          description: Code errors returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  totalCount:
                    type: integer
                    description: Total number of errors matching the filter criteria.
                  errors:
                    type: array
                    items:
                      $ref: '#/components/schemas/CodeError'
              examples:
                GetErrorsByBranch200Example:
                  summary: Default getErrorsByBranch 200 response
                  x-microcks-default: true
                  value:
                    totalCount: 352
                    errors:
                    - errorId: '770500'
                      policyId: '731580'
                      policyName: Staging Firewall 29
                      severity: HIGH
                      category: CICD
                      status: OPEN
                      resourceName: Corporate Agent 51
                      resourceType: custom
                      filePath: /api/v1/4ec64a
                      fileLineRange:
                      - 280
                      - 370
                      repositoryId: '404787'
                      branch: example-branch
                      guideline: example-guideline
                      firstDetected: '2026-10-23T03:12:18Z'
                      lastDetected: '2024-04-11T14:31:52Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    CodeError:
      type: object
      properties:
        errorId:
          type: string
          description: Unique error identifier.
          example: '770500'
        policyId:
          type: string
          description: Checkov policy ID that triggered the error (e.g., CKV_AWS_18).
          example: '731580'
        policyName:
          type: string
          description: Human-readable name of the violated policy.
          example: Staging Firewall 29
        severity:
          type: string
          enum:
          - CRITICAL
          - HIGH
          - MEDIUM
          - LOW
          - INFO
          description: Error severity level.
          example: HIGH
        category:
          type: string
          enum:
          - IAC
          - SCA
          - SECRETS
          - CICD
          description: Error category based on the type of scan that detected it.
          example: CICD
        status:
          type: string
          enum:
          - OPEN
          - SUPPRESSED
          - FIXED
          description: Current status of the error.
          example: OPEN
        resourceName:
          type: string
          description: Name of the IaC resource where the error was detected.
          example: Corporate Agent 51
        resourceType:
          type: string
          description: Type of the IaC resource.
          example: custom
        filePath:
          type: string
          description: Relative path to the file containing the error.
          example: /api/v1/4ec64a
        fileLineRange:
          type: array
          items:
            type: integer
          minItems: 2
          maxItems: 2
          description: Start and end line numbers of the affected code block.
          example:
          - 280
          - 370
        repositoryId:
          type: string
          description: Repository where the error was found.
          example: '404787'
        branch:
          type: string
          description: Branch where the error was detected.
          example: example-branch
        guideline:
          type: string
          description: URL to documentation explaining the policy and remediation steps.
          example: example-guideline
        firstDetected:
          type: string
          format: date-time
          description: Timestamp when the error was first detected.
          example: '2026-10-23T03:12:18Z'
        lastDetected:
          type: string
          format: date-time
          description: Timestamp of the most recent scan where the error was found.
          example: '2024-04-11T14:31:52Z'
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 602
        message:
          type: string
          description: Human-readable error message.
          example: Traffic activity investigation malware violation policy Security monitoring.
        error:
          type: string
          description: Error code.
          example: example-error
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.