openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Hosts API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Hosts
  description: Host machine security monitoring and vulnerability data.
paths:
  /hosts:
    get:
      operationId: getHosts
      summary: Palo Alto Networks List Host Scan Results
      description: Returns vulnerability and compliance scan results for all hosts protected by Prisma Cloud Compute Defenders. Includes OS-level vulnerabilities, installed packages, and compliance check results.
      tags:
      - Hosts
      parameters:
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 50
        example: 50
      - name: search
        in: query
        description: Search term to filter hosts by hostname.
        schema:
          type: string
        example: example-search
      - name: sort
        in: query
        description: Field to sort results by.
        schema:
          type: string
          enum:
          - vulnerabilities
          - compliance
          - scanTime
        example: compliance
      - name: reverse
        in: query
        description: Sort in reverse order.
        schema:
          type: boolean
          default: false
        example: false
      - name: collections
        in: query
        description: Filter by collection name.
        schema:
          type: string
        example: example-collections
      - name: clusters
        in: query
        description: Filter by cluster name.
        schema:
          type: string
        example: example-clusters
      responses:
        '200':
          description: Host scan results returned successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Host'
              examples:
                GetHosts200Example:
                  summary: Default getHosts 200 response
                  x-microcks-default: true
                  value:
                  - _id: '404955'
                    hostname: host-4848
                    scanTime: '2024-04-25T22:09:59Z'
                    osDistro: example-osDistro
                    osDistroVersion: 6.6.2
                    kernelVersion: 8.6.6
                    cloudMetadata:
                      provider: aws
                      accountId: '566631'
                      region: us-east-1
                      instanceId: '700233'
                    vulnerabilities:
                    - id: example-id
                      status: deferred
                      cvss: 13.89
                      severity: critical
                      packageName: Branch Policy 65
                      packageVersion: 2.9.1
                      fixedVersion: 9.6.0
                      link: https://api.example.com/9c88b4
                      description: Monitoring blocked suspicious activity malware traffic Security policy rule configured.
                      publishedDate: '2026-07-04T20:08:13Z'
                    vulnerabilitiesCount: 315
                    vulnerabilityDistribution:
                      critical: 842
                      high: 259
                      medium: 307
                      low: 195
                    complianceIssues:
                    - id: 799
                      title: Staging Gateway 66
                      severity: low
                      cause: example-cause
                      description: Endpoint endpoint blocked monitoring policy alert network traffic network monitoring applied investigation.
                    complianceIssuesCount: 960
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired authentication credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Vulnerability:
      type: object
      properties:
        id:
          type: string
          description: CVE identifier (e.g., CVE-2024-1234).
          example: example-id
        status:
          type: string
          enum:
          - fixed in
          - needed
          - will not fix
          - deferred
          description: Fix availability status.
          example: deferred
        cvss:
          type: number
          format: float
          description: CVSS v3 base score.
          example: 13.89
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          description: Severity level derived from CVSS score.
          example: critical
        packageName:
          type: string
          description: Name of the affected package.
          example: Branch Policy 65
        packageVersion:
          type: string
          description: Installed version of the affected package.
          example: 2.9.1
        fixedVersion:
          type: string
          description: Version that contains the fix, if available.
          example: 9.6.0
        link:
          type: string
          description: URL to the CVE advisory or details page.
          example: https://api.example.com/9c88b4
        description:
          type: string
          description: Brief description of the vulnerability.
          example: Monitoring blocked suspicious activity malware traffic Security policy rule configured.
        publishedDate:
          type: string
          format: date-time
          description: Date the vulnerability was publicly disclosed.
          example: '2026-07-04T20:08:13Z'
    Host:
      type: object
      properties:
        _id:
          type: string
          description: Unique host identifier.
          example: '404955'
        hostname:
          type: string
          description: Host machine hostname.
          example: host-4848
        scanTime:
          type: string
          format: date-time
          description: Timestamp of the most recent host scan.
          example: '2024-04-25T22:09:59Z'
        osDistro:
          type: string
          description: Operating system distribution.
          example: example-osDistro
        osDistroVersion:
          type: string
          description: Operating system version.
          example: 6.6.2
        kernelVersion:
          type: string
          description: Linux kernel version.
          example: 8.6.6
        cloudMetadata:
          type: object
          description: Cloud provider metadata for the host.
          properties:
            provider:
              type: string
              enum:
              - aws
              - azure
              - gcp
              - oci
              example: azure
            accountId:
              type: string
              example: '847408'
            region:
              type: string
              example: us-east-1
            instanceId:
              type: string
              example: '842603'
          example:
            provider: aws
            accountId: '566631'
            region: us-east-1
            instanceId: '700233'
        vulnerabilities:
          type: array
          description: Vulnerabilities discovered on the host.
          items:
            $ref: '#/components/schemas/Vulnerability'
          example:
          - id: example-id
            status: deferred
            cvss: 13.89
            severity: critical
            packageName: Branch Policy 65
            packageVersion: 2.9.1
            fixedVersion: 9.6.0
            link: https://api.example.com/9c88b4
            description: Monitoring blocked suspicious activity malware traffic Security policy rule configured.
            publishedDate: '2026-07-04T20:08:13Z'
        vulnerabilitiesCount:
          type: integer
          description: Total number of vulnerabilities found.
          example: 315
        vulnerabilityDistribution:
          type: object
          properties:
            critical:
              type: integer
              example: 687
            high:
              type: integer
              example: 527
            medium:
              type: integer
              example: 929
            low:
              type: integer
              example: 782
          example:
            critical: 842
            high: 259
            medium: 307
            low: 195
        complianceIssues:
          type: array
          items:
            $ref: '#/components/schemas/ComplianceIssue'
          example:
          - id: 799
            title: Staging Gateway 66
            severity: low
            cause: example-cause
            description: Endpoint endpoint blocked monitoring policy alert network traffic network monitoring applied investigation.
        complianceIssuesCount:
          type: integer
          example: 960
    ComplianceIssue:
      type: object
      properties:
        id:
          type: integer
          description: Compliance check ID.
          example: 668
        title:
          type: string
          description: Title of the compliance check.
          example: Primary Firewall 38
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          description: Severity of the compliance issue.
          example: high
        cause:
          type: string
          description: Explanation of why the resource failed the check.
          example: example-cause
        description:
          type: string
          description: Detailed description of the compliance requirement.
          example: Detected on policy monitoring detected alert.
    ErrorResponse:
      type: object
      properties:
        err:
          type: string
          description: Error message.
          example: example-err
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.