openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Fixes API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Fixes
  description: Automated fix suggestions for pull requests.
paths:
  /fixes/pull_request:
    get:
      operationId: getFixSuggestionsForPR
      summary: Palo Alto Networks Get Fix Suggestions for Pull Requests
      description: Returns automated fix suggestions for misconfigurations detected in a pull request or branch. Each fix includes the original code snippet, the suggested replacement, and the policy that triggered the finding. Fix suggestions are available for IaC files including Terraform, CloudFormation, and Kubernetes manifests.
      tags:
      - Fixes
      parameters:
      - name: repositoryId
        in: query
        required: true
        description: Repository identifier to retrieve fix suggestions for.
        schema:
          type: string
        example: '432434'
      - name: branch
        in: query
        description: Branch or pull request branch to retrieve fix suggestions for.
        schema:
          type: string
        example: example-branch
      - name: filePath
        in: query
        description: Filter fix suggestions by specific file path.
        schema:
          type: string
        example: /api/v1/81ae7f
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 25
        example: 25
      responses:
        '200':
          description: Fix suggestions returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  totalCount:
                    type: integer
                    description: Total number of available fix suggestions.
                  fixes:
                    type: array
                    items:
                      $ref: '#/components/schemas/Fix'
              examples:
                GetFixSuggestionsForPr200Example:
                  summary: Default getFixSuggestionsForPR 200 response
                  x-microcks-default: true
                  value:
                    totalCount: 786
                    fixes:
                    - fixId: '465958'
                      policyId: '290769'
                      policyName: Primary Policy 52
                      severity: INFO
                      resourceName: Staging Sensor 42
                      filePath: /api/v1/69ba75
                      lineRange:
                      - 799
                      - 127
                      originalCode: example-originalCode
                      suggestedCode: example-suggestedCode
                      framework: ARM
                      repositoryId: '212627'
                      branch: example-branch
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 602
        message:
          type: string
          description: Human-readable error message.
          example: Traffic activity investigation malware violation policy Security monitoring.
        error:
          type: string
          description: Error code.
          example: example-error
    Fix:
      type: object
      properties:
        fixId:
          type: string
          description: Unique fix suggestion identifier.
          example: '465958'
        policyId:
          type: string
          description: Checkov policy ID associated with the fix.
          example: '290769'
        policyName:
          type: string
          description: Human-readable policy name.
          example: Primary Policy 52
        severity:
          type: string
          enum:
          - CRITICAL
          - HIGH
          - MEDIUM
          - LOW
          - INFO
          description: Severity of the original finding.
          example: INFO
        resourceName:
          type: string
          description: IaC resource name where the fix applies.
          example: Staging Sensor 42
        filePath:
          type: string
          description: Relative path to the file requiring the fix.
          example: /api/v1/69ba75
        lineRange:
          type: array
          items:
            type: integer
          minItems: 2
          maxItems: 2
          description: Start and end line numbers of the code to be replaced.
          example:
          - 799
          - 127
        originalCode:
          type: string
          description: Original code snippet that contains the misconfiguration.
          example: example-originalCode
        suggestedCode:
          type: string
          description: Suggested replacement code that resolves the misconfiguration.
          example: example-suggestedCode
        framework:
          type: string
          enum:
          - Terraform
          - CloudFormation
          - Kubernetes
          - Helm
          - Dockerfile
          - ARM
          - Bicep
          description: IaC framework of the affected file.
          example: ARM
        repositoryId:
          type: string
          description: Repository where the fix applies.
          example: '212627'
        branch:
          type: string
          description: Branch where the fix applies.
          example: example-branch
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.