openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend IDP API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: IDP
paths:
  /sspm/identity/v1/idps:
    get:
      summary: Palo Alto Networks Get All Identity Providers
      description: Retrieve a list of identity providers (Identity Providers) configured for the tenant. You can optionally filter the results to view only designated identity providers.
      operationId: idps_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseIdpInfo'
              examples:
                IdpsGet200Example:
                  summary: Default idps_get 200 response
                  x-microcks-default: true
                  value:
                    total: 620
                    items:
                    - displayName: Branch Sensor 08
                      idpId: '800802'
                      appType: standard
        '404':
          description: Not Found
      parameters:
      - name: designated
        in: query
        schema:
          type: boolean
        example: false
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      summary: Palo Alto Networks Create Identity Provider
      description: Create a new identity provider (Identity Provider) entry for the tenant. You can specify the type, identifier, and whether it should be marked as designated.
      operationId: idps_post
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: designated
        in: query
        schema:
          type: boolean
        example: true
      - name: idpId
        in: query
        schema:
          type: string
        example: '101857'
      - name: idpType
        in: query
        schema:
          type: string
        example: advanced
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/accounts/logout:
    get:
      summary: Palo Alto Networks Get Logout Status
      description: Retrieve the logout status of user accounts associated with the specified identity provider (Identity Provider). This is useful for tracking the outcome of account logout actions in batch operations.
      operationId: idps_accounts_logout_get
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '339256'
      - name: batch_id
        in: query
        schema:
          type: string
        example: '465701'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      summary: Palo Alto Networks Trigger Account Logout
      description: Initiate a logout request for user accounts associated with the specified identity provider (Identity Provider). This action helps enforce session termination for compliance or security purposes.
      operationId: idps_accounts_logout_post
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '650260'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationRequest'
            examples:
              IdpsAccountsLogoutPostRequestExample:
                summary: Default idps_accounts_logout_post request
                x-microcks-default: true
                value:
                  users:
                  - example-users_item
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/feature_state:
    get:
      summary: Palo Alto Networks Get Identity Provider Feature State
      description: Retrieve the current status and last scan timestamp of a specific feature enabled for the identity provider (Identity Provider). This helps assess feature health and scan recency.
      operationId: idps_feature_state_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FeatureState'
              examples:
                IdpsFeatureStateGet200Example:
                  summary: Default idps_feature_state_get 200 response
                  x-microcks-default: true
                  value:
                    status: enabled
                    lastScannedAt: 2022-03-10 16:15:50+00:00
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '359166'
      - name: feature
        in: query
        schema:
          $ref: '#/components/schemas/Feature'
        example: ENROLLMENT
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/idp_accounts/count:
    get:
      summary: Palo Alto Networks Get Identity Provider Account Count
      description: Return the number of user accounts linked to the specified identity provider (Identity Provider). Filtering options can be applied to count specific types of accounts such as orphaned or privileged users.
      operationId: idps_idp_accounts_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
              examples:
                IdpsIdpAccountsCountGet200Example:
                  summary: Default idps_idp_accounts_count_get 200 response
                  x-microcks-default: true
                  value: {}
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '479701'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report:
    post:
      summary: Palo Alto Networks Generate Identity Provider Account CSV Report
      description: Generate a CSV report of accounts associated with the specified identity provider (Identity Provider). The report supports compliance audits and user access reviews.
      operationId: idps_idp_accounts_csv_report_get
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '489324'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
            examples:
              IdpsIdpAccountsCsvReportGetRequestExample:
                summary: Default idps_idp_accounts_csv_report_get request
                x-microcks-default: true
                value:
                  userFullName: soc-analyst
                  userEmail: example-userEmail
                  service: example-service
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/mfa_activity:
    get:
      summary: Palo Alto Networks Get Multi-factor Authentication Activity Logs
      description: Retrieve a list of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). The logs include user identities, timestamps, IP Address addresses, and Multi-factor authentication methods used.
      operationId: idps_mfa_activity_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseMfaActivity'
              examples:
                IdpsMfaActivityGet200Example:
                  summary: Default idps_mfa_activity_get 200 response
                  x-microcks-default: true
                  value:
                    total: 724
                    items:
                    - id: example-id
                      tenant: example-tenant
                      userId: '820434'
                      idpId: '389141'
                      idpType: custom
                      mfaStrength: example-mfaStrength
                      admin: true
                      appType: advanced
                      appId: '226503'
                      timestamp: &id001 2022-03-10 16:15:50+00:00
                      mfaFactors: example-mfaFactors
                      saasProviderMfaType: custom
                      fullName: Corporate Sensor 50
                      email: soc-admin@example.com
                      ipAddress: 10.129.29.50
                      location: example-location
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
                    - id: example-id
                      tenant: example-tenant
                      userId: '829660'
                      idpId: '133263'
                      idpType: standard
                      mfaStrength: example-mfaStrength
                      admin: true
                      appType: advanced
                      appId: '947066'
                      timestamp: *id001
                      mfaFactors: example-mfaFactors
                      saasProviderMfaType: standard
                      fullName: Corporate Firewall 28
                      email: security-ops@example.com
                      ipAddress: 10.81.194.228
                      location: example-location
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '701548'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 896
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 778
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/mfa_activity/count:
    get:
      summary: Palo Alto Networks Get Multi-factor Authentication Activity Count
      description: Return the number of multi-factor authentication (Multi-factor authentication) activities recorded for the specified identity provider (Identity Provider). This count helps evaluate authentication volume and usage patterns.
      operationId: idps_mfa_activity_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
              examples:
                IdpsMfaActivityCountGet200Example:
                  summary: Default idps_mfa_activity_count_get 200 response
                  x-microcks-default: true
                  value: {}
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '726859'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type:
    get:
      summary: Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
      description: Return the number of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider), grouped by application type. This helps analyze authentication trends across different SaaS applications.
      operationId: idps_mfa_activity_count_by_app_type_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/MfaActivityCountByAppType'
              examples:
                IdpsMfaActivityCountByAppTypeGet200Example:
                  summary: Default idps_mfa_activity_count_by_app_type_get 200 response
                  x-microcks-default: true
                  value:
                  - appType: advanced
                    count: 967
                    iconAppType: standard
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '826348'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 853
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 567
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/idps/{idpId}/mfa_activity/csv_report:
    post:
      summary: Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report
      description: Generate a comma-separated values (CSV) report of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). This report helps audit authentication patterns and policy compliance.
      operationId: idps_mfa_activity_csv_report_get
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '993198'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
            examples:
              IdpsMfaActivityCsvReportGetRequestExample:
                summary: Default idps_mfa_activity_csv_report_get request
                x-microcks-default: true
                value:
                  userFullName: soc-analyst
                  userEmail: example-userEmail
                  service: example-service
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    MfaActivity:
      type: object
      properties:
        id:
          type: string
          example: example-id
        tenant:
          type: string
          example: example-tenant
        userId:
          type: string
          example: '988415'
        idpId:
          type: string
          example: '797020'
        idpType:
          type: string
          example: custom
        mfaStrength:
          type: string
          example: example-mfaStrength
        admin:
          type: boolean
          example: false
        appType:
          type: string
          example: advanced
        appId:
          type: string
          example: '282235'
        timestamp:
          $ref: '#/components/schemas/Instant'
        mfaFactors:
          type: string
          example: example-mfaFactors
        saasProviderMfaType:
          type: string
          example: advanced
        fullName:
          type: string
          example: Branch Policy 87
        email:
          type: string
          example: soc-admin@example.com
        ipAddress:
          type: string
          example: 10.152.115.236
        location:
          type: string
          example: example-location
        ticketKey:
          type: string
          example: example-ticketKey
        ticketUrl:
          type: string
          example: example-ticketUrl
    MfaActivityCountByAppType:
      type: object
      properties:
        appType:
          type: string
          example: advanced
        count:
          format: int64
          type: integer
          example: 967
        iconAppType:
          type: string
          example: standard
    Instant:
      format: date-time
      type: string
      example: 2022-03-10 16:15:50+00:00
    ListResponseIdpInfo:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 620
        items:
          type: array
          items:
            $ref: '#/components/schemas/IdpInfo'
          example:
          - displayName: Branch Sensor 08
            idpId: '800802'
            appType: standard
    ListResponseMfaActivity:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 724
        items:
          type: array
          items:
            $ref: '#/components/schemas/MfaActivity'
          example:
          - id: example-id
            tenant: example-tenant
            userId: '820434'
            idpId: '389141'
            idpType: custom
            mfaStrength: example-mfaStrength
            admin: true
            appType: advanced
            appId: '226503'
            timestamp: &id002 2022-03-10 16:15:50+00:00
            mfaFactors: example-mfaFactors
            saasProviderMfaType: custom
            fullName: Corporate Sensor 50
            email: soc-admin@example.com
            ipAddress: 10.129.29.50
            location: example-location
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
          - id: example-id
            tenant: example-tenant
            userId: '829660'
            idpId: '133263'
            idpType: standard
            mfaStrength: example-mfaStrength
            admin: true
            appType: advanced
            appId: '947066'
            timestamp: *id002
            mfaFactors: example-mfaFactors
            saasProviderMfaType: standard
            fullName: Corporate Firewall 28
            email: security-ops@example.com
            ipAddress: 10.81.194.228
            location: example-location
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
    DownloadCsvRequest:
      required:
      - userFullName
      - userEmail
      - service
      type: object
      properties:
        userFullName:
          type: string
          example: soc-analyst
        userEmail:
          type: string
          example: example-userEmail
        service:
          type: string
          example: example-service
    IdpInfo:
      type: object
      properties:
        displayName:
          type: string
          example: Branch Sensor 08
        idpId:
          type: string
          example: '800802'
        appType:
          type: string
          example: standard
    FeatureState:
      type: object
      properties:
        status:
          type: string
          example: enabled
        lastScannedAt:
          $ref: '#/components/schemas/Instant'
    Feature:
      enum:
      - ENROLLMENT
      - ACTIVITY
      - LOGOUT
      - IDENTITY_NHI
      - IDENTITY_ACTIVITY
      type: string
    RemediationRequest:
      type: object
      properties:
        users:
          type: array
          items:
            type: string
          example:
          - example-users_item
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.