openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Ingestion API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Ingestion
  description: Data source configuration for log ingestion.
paths:
  /ingestion/datasources:
    post:
      operationId: configureDatasource
      summary: Palo Alto Networks Configure Data Source
      description: Configures a new data source for log ingestion into XSIAM. Data sources define the schema, parsing rules, and normalization mappings for third-party log formats. Enables XSIAM to ingest and correlate data from firewalls, cloud platforms, SaaS applications, and custom sources.
      tags:
      - Ingestion
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - name
                  - vendor
                  - product
                  properties:
                    name:
                      type: string
                      description: Unique name for this data source configuration.
                    vendor:
                      type: string
                      description: Vendor name of the data source (e.g., Palo Alto Networks).
                    product:
                      type: string
                      description: Product name (e.g., PAN-OS, Prisma Access).
                    type:
                      type: string
                      enum:
                      - syslog
                      - https
                      - api
                      - file
                      description: Ingestion method for this data source.
                    parsing_rule:
                      type: string
                      description: XDL (XSIAM Definition Language) parsing rule for extracting fields from raw log data.
                    mapping_fields:
                      type: object
                      description: Field name mapping from source fields to XSIAM schema fields.
                      additionalProperties:
                        type: string
                    enabled:
                      type: boolean
                      default: true
            examples:
              ConfigureDatasourceRequestExample:
                summary: Default configureDatasource request
                x-microcks-default: true
                value:
                  request_data:
                    name: Staging Policy 70
                    vendor: Palo Alto Networks
                    product: example-product
                    type: syslog
                    parsing_rule: example-parsing_rule
                    mapping_fields: {}
                    enabled: true
      responses:
        '200':
          description: Data source configured successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      datasource_id:
                        type: string
                        description: Unique identifier assigned to the new data source.
                      name:
                        type: string
                      status:
                        type: string
                        enum:
                        - ACTIVE
                        - PENDING
                        - ERROR
              examples:
                ConfigureDatasource200Example:
                  summary: Default configureDatasource 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      datasource_id: '995974'
                      name: Corporate Policy 49
                      status: PENDING
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication headers.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request body or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 140
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 33
            err_msg: example-err_msg
            err_extra: example-err_extra
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.