openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend FQDN Rules API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: FQDN Rules
  description: FQDN-based access rules for ZTNA applications.
paths:
  /v2/fqdn-rules:
    get:
      operationId: listFQDNRules
      summary: Palo Alto Networks List FQDN-based Access Rules
      description: Returns the list of FQDN-based access rules that define which hostnames are accessible through ZTNA. FQDN rules specify the domain patterns and ports that users can reach through a connector group.
      tags:
      - FQDN Rules
      responses:
        '200':
          description: FQDN rules returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/FQDNRule'
              examples:
                ListFqdnrules200Example:
                  summary: Default listFQDNRules 200 response
                  x-microcks-default: true
                  value:
                    total: 856
                    items:
                    - rule_id: '519537'
                      name: Corporate Gateway 72
                      fqdn_pattern: example-fqdn_pattern
                      group_id: '945832'
                      ports: &id001
                      - 96
                      - 621
                      enabled: true
                      created_at: '2026-08-05T06:31:43Z'
                    - rule_id: '519537'
                      name: Corporate Gateway 72
                      fqdn_pattern: example-fqdn_pattern
                      group_id: '945832'
                      ports: *id001
                      enabled: true
                      created_at: '2026-08-05T06:31:43Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListFqdnrules401Example:
                  summary: Default listFQDNRules 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListFqdnrules403Example:
                  summary: Default listFQDNRules 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListFqdnrules500Example:
                  summary: Default listFQDNRules 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createFQDNRule
      summary: Palo Alto Networks Create FQDN-based Access Rule
      description: Creates a new FQDN-based access rule for ZTNA.
      tags:
      - FQDN Rules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FQDNRuleRequest'
            examples:
              CreateFqdnruleRequestExample:
                summary: Default createFQDNRule request
                x-microcks-default: true
                value:
                  name: Corporate Agent 77
                  fqdn_pattern: example-fqdn_pattern
                  group_id: '533942'
                  ports:
                  - 505
                  enabled: true
      responses:
        '201':
          description: FQDN rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FQDNRule'
              examples:
                CreateFqdnrule201Example:
                  summary: Default createFQDNRule 201 response
                  x-microcks-default: true
                  value:
                    rule_id: '519537'
                    name: Corporate Gateway 72
                    fqdn_pattern: example-fqdn_pattern
                    group_id: '945832'
                    ports:
                    - 96
                    - 621
                    enabled: true
                    created_at: '2026-08-05T06:31:43Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateFqdnrule400Example:
                  summary: Default createFQDNRule 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateFqdnrule401Example:
                  summary: Default createFQDNRule 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateFqdnrule403Example:
                  summary: Default createFQDNRule 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateFqdnrule500Example:
                  summary: Default createFQDNRule 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    FQDNRule:
      type: object
      properties:
        rule_id:
          type: string
          description: Unique identifier of the FQDN rule.
          example: '519537'
        name:
          type: string
          description: Display name of the rule.
          example: Corporate Gateway 72
        fqdn_pattern:
          type: string
          description: FQDN pattern or wildcard (e.g., *.internal.example.com) that this rule matches.
          example: example-fqdn_pattern
        group_id:
          type: string
          description: Connector group used to resolve and access matching FQDNs.
          example: '945832'
        ports:
          type: array
          items:
            type: integer
          description: Ports covered by this rule.
          example:
          - 96
          - 621
        enabled:
          type: boolean
          description: Whether this rule is active.
          example: true
        created_at:
          type: string
          format: date-time
          example: '2026-08-05T06:31:43Z'
    FQDNRuleRequest:
      type: object
      required:
      - name
      - fqdn_pattern
      - group_id
      properties:
        name:
          type: string
          description: Display name for the FQDN rule.
          example: Corporate Agent 77
        fqdn_pattern:
          type: string
          description: FQDN pattern or wildcard this rule matches.
          example: example-fqdn_pattern
        group_id:
          type: string
          description: Connector group to use for matching FQDNs.
          example: '533942'
        ports:
          type: array
          items:
            type: integer
          description: Ports covered by this rule.
          example:
          - 505
        enabled:
          type: boolean
          default: true
          example: true
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Security firewall network configured traffic blocked threat.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 709c60bb-8234-4bc4-938b-d0835224c350
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.