openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend IKEGateways API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: IKEGateways
  description: IKE gateway configuration for establishing IPSec VPN tunnels to Prisma Access.
paths:
  /ike-gateways:
    get:
      operationId: listIKEGateways
      summary: Palo Alto Networks List IKE Gateways
      description: Returns a list of IKE gateway configurations. IKE gateways define the parameters for establishing the IKE phase 1 negotiation used by IPSec VPN tunnels connecting to Prisma Access.
      tags:
      - IKEGateways
      parameters:
      - name: folder
        in: query
        description: Filter by folder.
        schema:
          type: string
        example: example-folder
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 200
        example: 200
      responses:
        '200':
          description: IKE gateways returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IKEGateway'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListIkegateways200Example:
                  summary: Default listIKEGateways 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Branch Sensor 55
                      version: ikev2-preferred
                      peer_address: &id001
                        ip: 10.213.81.33
                        dynamic: true
                      authentication: &id002
                        pre_shared_key: example-pre_shared_key
                        certificate:
                          local_certificate: example-local_certificate
                      local_id: &id003
                        type: fqdn
                        id: example-id
                      peer_id: &id004
                        type: ufqdn
                        id: example-id
                      folder: example-folder
                    - id: example-id
                      name: Branch Sensor 55
                      version: ikev2-preferred
                      peer_address: *id001
                      authentication: *id002
                      local_id: *id003
                      peer_id: *id004
                      folder: example-folder
                    offset: 969
                    total: 242
                    limit: 163
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createIKEGateway
      summary: Palo Alto Networks Create an IKE Gateway
      description: Creates a new IKE gateway in the candidate configuration.
      tags:
      - IKEGateways
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the IKE gateway.
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IKEGateway'
            examples:
              CreateIkegatewayRequestExample:
                summary: Default createIKEGateway request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 55
                  version: ikev2-preferred
                  peer_address: &id005
                    ip: 10.213.81.33
                    dynamic: true
                  authentication: &id006
                    pre_shared_key: example-pre_shared_key
                    certificate:
                      local_certificate: example-local_certificate
                  local_id: &id007
                    type: fqdn
                    id: example-id
                  peer_id: &id008
                    type: ufqdn
                    id: example-id
                  folder: example-folder
      responses:
        '201':
          description: IKE gateway created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IKEGateway'
              examples:
                CreateIkegateway201Example:
                  summary: Default createIKEGateway 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 55
                    version: ikev2-preferred
                    peer_address: *id005
                    authentication: *id006
                    local_id: *id007
                    peer_id: *id008
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /ike-gateways/{id}:
    get:
      operationId: getIKEGateway
      summary: Palo Alto Networks Get an IKE Gateway
      description: Returns the configuration of a specific IKE gateway.
      tags:
      - IKEGateways
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IKE gateway identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IKE gateway returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IKEGateway'
              examples:
                GetIkegateway200Example:
                  summary: Default getIKEGateway 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 55
                    version: ikev2-preferred
                    peer_address:
                      ip: 10.213.81.33
                      dynamic: true
                    authentication:
                      pre_shared_key: example-pre_shared_key
                      certificate:
                        local_certificate: example-local_certificate
                    local_id:
                      type: fqdn
                      id: example-id
                    peer_id:
                      type: ufqdn
                      id: example-id
                    folder: example-folder
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateIKEGateway
      summary: Palo Alto Networks Update an IKE Gateway
      description: Updates an existing IKE gateway in the candidate configuration.
      tags:
      - IKEGateways
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IKE gateway identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IKEGateway'
            examples:
              UpdateIkegatewayRequestExample:
                summary: Default updateIKEGateway request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 55
                  version: ikev2-preferred
                  peer_address: &id009
                    ip: 10.213.81.33
                    dynamic: true
                  authentication: &id010
                    pre_shared_key: example-pre_shared_key
                    certificate:
                      local_certificate: example-local_certificate
                  local_id: &id011
                    type: fqdn
                    id: example-id
                  peer_id: &id012
                    type: ufqdn
                    id: example-id
                  folder: example-folder
      responses:
        '200':
          description: IKE gateway updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IKEGateway'
              examples:
                UpdateIkegateway200Example:
                  summary: Default updateIKEGateway 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 55
                    version: ikev2-preferred
                    peer_address: *id009
                    authentication: *id010
                    local_id: *id011
                    peer_id: *id012
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteIKEGateway
      summary: Palo Alto Networks Delete an IKE Gateway
      description: Deletes an IKE gateway from the candidate configuration.
      tags:
      - IKEGateways
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IKE gateway identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IKE gateway deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Alert malware configured threat rule network malware configured on.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Threat configured alert firewall violation monitoring traffic activity.
            details: {}
          - code: example-code
            message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network.
            details: {}
        _request_id:
          type: string
          example: '980164'
    IKEGateway:
      type: object
      required:
      - name
      - peer_address
      - authentication
      properties:
        id:
          type: string
          description: Unique identifier for the IKE gateway.
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name of the IKE gateway.
          example: Branch Sensor 55
        version:
          type: string
          enum:
          - ikev1
          - ikev2
          - ikev2-preferred
          default: ikev2-preferred
          description: IKE protocol version.
          example: ikev2-preferred
        peer_address:
          type: object
          description: Peer IP address configuration.
          properties:
            ip:
              type: string
              format: ipv4
              description: Static peer IP address.
              example: 10.81.220.11
            dynamic:
              type: boolean
              description: Whether the peer address is dynamic.
              example: false
          example:
            ip: 10.213.81.33
            dynamic: true
        authentication:
          type: object
          description: IKE authentication configuration.
          properties:
            pre_shared_key:
              type: string
              description: Pre-shared key for IKE authentication.
              example: example-pre_shared_key
            certificate:
              type: object
              properties:
                local_certificate:
                  type: string
                  description: Local certificate profile name.
                  example: example-local_certificate
              example:
                local_certificate: example-local_certificate
          example:
            pre_shared_key: example-pre_shared_key
            certificate:
              local_certificate: example-local_certificate
        local_id:
          type: object
          properties:
            type:
              type: string
              enum:
              - ipaddr
              - keyid
              - fqdn
              - ufqdn
              example: ufqdn
            id:
              type: string
              example: example-id
          example:
            type: fqdn
            id: example-id
        peer_id:
          type: object
          properties:
            type:
              type: string
              enum:
              - ipaddr
              - keyid
              - fqdn
              - ufqdn
              example: ipaddr
            id:
              type: string
              example: example-id
          example:
            type: ufqdn
            id: example-id
        folder:
          type: string
          readOnly: true
          example: example-folder
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.