openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Firewalls API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Firewalls
  description: Cloud NGFW firewall instance management.
paths:
  /config/ngfirewalls:
    get:
      operationId: listFirewalls
      summary: Palo Alto Networks List Cloud NGFW Firewalls
      description: Returns a paginated list of all Cloud NGFW firewall instances in the AWS account. Each entry includes configuration, associated rule stack, VPC attachment, and operational status.
      tags:
      - Firewalls
      parameters:
      - name: maxresults
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      - name: nexttoken
        in: query
        schema:
          type: string
        example: example-nexttoken
      - name: vpcid
        in: query
        description: Filter firewalls by AWS VPC ID.
        schema:
          type: string
        example: '161612'
      responses:
        '200':
          description: Firewalls returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      Firewalls:
                        type: array
                        items:
                          $ref: '#/components/schemas/FirewallSummary'
                      NextToken:
                        type: string
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListFirewalls200Example:
                  summary: Default listFirewalls 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      Firewalls:
                      - FirewallName: Production Gateway 93
                        VpcId: '780399'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        Status: running
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createFirewall
      summary: Palo Alto Networks Create Cloud NGFW Firewall
      description: Creates a new Cloud NGFW firewall instance in the specified VPC. Specify the associated rule stack, VPC and subnet mappings for endpoint creation, and optional logging configuration.
      tags:
      - Firewalls
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirewallRequest'
            examples:
              CreateFirewallRequestExample:
                summary: Default createFirewall request
                x-microcks-default: true
                value:
                  FirewallName: Production Sensor 15
                  FirewallEntry:
                    Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
                    VpcId: '911913'
                    AssociatedRuleStack: example-AssociatedRuleStack
                    SubnetMappings:
                    - SubnetId: '671001'
                    - SubnetId: '304867'
                    Tags:
                    - Key: example-Key
                      Value: example-Value
      responses:
        '200':
          description: Firewall created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateFirewall200Example:
                  summary: Default createFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /config/ngfirewalls/{firewall}:
    get:
      operationId: getFirewall
      summary: Palo Alto Networks Get Cloud NGFW Firewall
      description: Returns the configuration and status of a specific Cloud NGFW firewall instance.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      responses:
        '200':
          description: Firewall returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                GetFirewall200Example:
                  summary: Default getFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateFirewall
      summary: Palo Alto Networks Update Cloud NGFW Firewall
      description: Updates the configuration of an existing Cloud NGFW firewall instance, such as changing the associated rule stack or updating subnet mappings.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirewallRequest'
            examples:
              UpdateFirewallRequestExample:
                summary: Default updateFirewall request
                x-microcks-default: true
                value:
                  FirewallName: Production Sensor 15
                  FirewallEntry:
                    Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
                    VpcId: '911913'
                    AssociatedRuleStack: example-AssociatedRuleStack
                    SubnetMappings:
                    - SubnetId: '671001'
                    - SubnetId: '304867'
                    Tags:
                    - Key: example-Key
                      Value: example-Value
      responses:
        '200':
          description: Firewall updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                UpdateFirewall200Example:
                  summary: Default updateFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteFirewall
      summary: Palo Alto Networks Delete Cloud NGFW Firewall
      description: Deletes a Cloud NGFW firewall instance. This disassociates the firewall from the VPC and removes all associated endpoints. The firewall must be in a PROVISIONING or ACTIVE state to be deleted.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      responses:
        '200':
          description: Firewall deletion initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                DeleteFirewall200Example:
                  summary: Default deleteFirewall 200 response
                  x-microcks-default: true
                  value:
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    FirewallRequest:
      type: object
      required:
      - FirewallName
      - FirewallEntry
      properties:
        FirewallName:
          type: string
          example: Production Sensor 15
        FirewallEntry:
          type: object
          required:
          - VpcId
          - AssociatedRuleStack
          - SubnetMappings
          properties:
            Description:
              type: string
              example: Activity incident alert configured firewall suspicious policy.
            VpcId:
              type: string
              example: '226288'
            AssociatedRuleStack:
              type: string
              example: example-AssociatedRuleStack
            SubnetMappings:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    example: '436036'
              example:
              - SubnetId: '355983'
            Tags:
              type: array
              items:
                type: object
                properties:
                  Key:
                    type: string
                    example: example-Key
                  Value:
                    type: string
                    example: example-Value
              example:
              - Key: example-Key
                Value: example-Value
              - Key: example-Key
                Value: example-Value
          example:
            Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
            VpcId: '911913'
            AssociatedRuleStack: example-AssociatedRuleStack
            SubnetMappings:
            - SubnetId: '671001'
            - SubnetId: '304867'
            Tags:
            - Key: example-Key
              Value: example-Value
    FirewallSummary:
      type: object
      properties:
        FirewallName:
          type: string
          example: Production Gateway 93
        VpcId:
          type: string
          example: '780399'
        AssociatedRuleStack:
          type: string
          example: example-AssociatedRuleStack
        Status:
          type: string
          example: running
    Firewall:
      type: object
      description: A Cloud NGFW firewall instance deployed in an AWS VPC.
      properties:
        FirewallName:
          type: string
          example: Corporate Policy 70
        FirewallEntry:
          type: object
          properties:
            Description:
              type: string
              example: Malware endpoint incident policy endpoint on applied rule applied.
            VpcId:
              type: string
              description: AWS VPC ID where the firewall is deployed.
              example: '886305'
            AssociatedRuleStack:
              type: string
              description: Name of the rule stack associated with this firewall.
              example: example-AssociatedRuleStack
            SubnetMappings:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    description: AWS subnet ID for the firewall endpoint.
                    example: '124164'
                  AvailabilityZone:
                    type: string
                    example: untrust
              example:
              - SubnetId: '297621'
                AvailabilityZone: dmz
              - SubnetId: '781667'
                AvailabilityZone: untrust
            Tags:
              type: array
              items:
                type: object
                properties:
                  Key:
                    type: string
                    example: example-Key
                  Value:
                    type: string
                    example: example-Value
              example:
              - Key: example-Key
                Value: example-Value
              - Key: example-Key
                Value: example-Value
          example:
            Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
            VpcId: '325753'
            AssociatedRuleStack: example-AssociatedRuleStack
            SubnetMappings:
            - SubnetId: '207407'
              AvailabilityZone: untrust
            Tags:
            - Key: example-Key
              Value: example-Value
        FirewallStatus:
          type: object
          properties:
            FirewallStatus:
              type: string
              enum:
              - PROVISIONING
              - ACTIVE
              - DELETING
              - FAILED
              example: FAILED
            Attachments:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    example: '513355'
                  EndpointId:
                    type: string
                    example: '268654'
                  Status:
                    type: string
                    example: active
              example:
              - SubnetId: '690238'
                EndpointId: '699787'
                Status: active
              - SubnetId: '994368'
                EndpointId: '479951'
                Status: running
          example:
            FirewallStatus: DELETING
            Attachments:
            - SubnetId: '241296'
              EndpointId: '635794'
              Status: enabled
            - SubnetId: '713413'
              EndpointId: '622390'
              Status: active
    ErrorResponse:
      type: object
      properties:
        ResponseStatus:
          type: object
          properties:
            ErrorCode:
              type: integer
              example: 869
            Reason:
              type: string
              example: Blocked investigation activity firewall activity malware network on applied.
          example:
            ErrorCode: 719
            Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
    ResponseStatus:
      type: object
      description: Standard API response status envelope included in all responses.
      properties:
        ErrorCode:
          type: integer
          description: Error code. 0 indicates success.
          example: 0
        Reason:
          type: string
          description: Human-readable status message.
          example: ''
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or cannot be modified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid AWS credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  parameters:
    firewall:
      name: firewall
      in: path
      required: true
      description: Name of the Cloud NGFW firewall instance.
      schema:
        type: string
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.