openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend FQDNLists API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: FQDNLists
  description: FQDN list management for use in security rule destination criteria.
paths:
  /config/rulestacks/{rulestack}/fqdnlists:
    get:
      operationId: listFqdnLists
      summary: Palo Alto Networks List FQDN Lists
      description: Returns all FQDN lists in the specified rule stack. FQDN lists contain domain name entries referenced in security rule destination criteria.
      tags:
      - FQDNLists
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - name: maxresults
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      - name: nexttoken
        in: query
        schema:
          type: string
        example: example-nexttoken
      responses:
        '200':
          description: FQDN lists returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      FqdnListCandidates:
                        type: array
                        items:
                          $ref: '#/components/schemas/FqdnListSummary'
                      NextToken:
                        type: string
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListFqdnLists200Example:
                  summary: Default listFqdnLists 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FqdnListCandidates:
                      - FqdnListName: Primary Firewall 80
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createFqdnList
      summary: Palo Alto Networks Create FQDN List
      description: Creates a new FQDN list in the rule stack with a set of domain name entries.
      tags:
      - FQDNLists
      parameters:
      - $ref: '#/components/parameters/rulestack'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FqdnListRequest'
            examples:
              CreateFqdnListRequestExample:
                summary: Default createFqdnList request
                x-microcks-default: true
                value:
                  FqdnListName: Primary Agent 55
                  FqdnListEntry:
                    Description: Network rule endpoint traffic suspicious on configured suspicious policy violation detected.
                    FqdnList:
                    - example-FqdnList_item
                    - example-FqdnList_item
      responses:
        '200':
          description: FQDN list created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/FqdnList'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateFqdnList200Example:
                  summary: Default createFqdnList 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FqdnListName: Production Firewall 87
                      FqdnListEntry:
                        Description: Incident configured activity on configured detected alert investigation policy blocked incident.
                        FqdnList:
                        - example-FqdnList_item
                      UpdateToken: example-UpdateToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    FqdnListSummary:
      type: object
      properties:
        FqdnListName:
          type: string
          example: Primary Firewall 80
    FqdnList:
      type: object
      description: An FQDN list containing domain name entries for use in security rule destination criteria.
      properties:
        FqdnListName:
          type: string
          example: Production Firewall 87
        FqdnListEntry:
          type: object
          properties:
            Description:
              type: string
              example: Suspicious incident incident network firewall alert applied traffic blocked firewall policy violation.
            FqdnList:
              type: array
              items:
                type: string
              description: Fully qualified domain names (e.g., example.com, *.example.com).
              example:
              - example-FqdnList_item
              - example-FqdnList_item
          example:
            Description: Incident configured activity on configured detected alert investigation policy blocked incident.
            FqdnList:
            - example-FqdnList_item
        UpdateToken:
          type: string
          example: example-UpdateToken
    FqdnListRequest:
      type: object
      required:
      - FqdnListName
      - FqdnListEntry
      properties:
        FqdnListName:
          type: string
          example: Primary Agent 55
        FqdnListEntry:
          type: object
          required:
          - FqdnList
          properties:
            Description:
              type: string
              example: Suspicious violation threat network rule firewall network.
            FqdnList:
              type: array
              items:
                type: string
              example:
              - example-FqdnList_item
              - example-FqdnList_item
          example:
            Description: Network rule endpoint traffic suspicious on configured suspicious policy violation detected.
            FqdnList:
            - example-FqdnList_item
            - example-FqdnList_item
    ErrorResponse:
      type: object
      properties:
        ResponseStatus:
          type: object
          properties:
            ErrorCode:
              type: integer
              example: 869
            Reason:
              type: string
              example: Blocked investigation activity firewall activity malware network on applied.
          example:
            ErrorCode: 719
            Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
    ResponseStatus:
      type: object
      description: Standard API response status envelope included in all responses.
      properties:
        ErrorCode:
          type: integer
          description: Error code. 0 indicates success.
          example: 0
        Reason:
          type: string
          description: Human-readable status message.
          example: ''
  parameters:
    rulestack:
      name: rulestack
      in: path
      required: true
      description: Name of the rule stack.
      schema:
        type: string
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or cannot be modified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid AWS credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.