openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend IP Pool API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: IP Pool
paths:
  /mt/sp-interconnect/interconnects/{interconnectId}/ip-pool:
    put:
      tags:
      - IP Pool
      summary: Palo Alto Networks Update IP Address Pool
      description: Update IP Address Pool.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '716104'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IPPoolRequest'
            examples:
              Update IP Pool with new CIDRs:
                value:
                  ipProvider: SP
                  ipBlocks:
                  - edgeLocation: mexico-central
                    cidr:
                    - 21.58.2.0/29
                    - 21.58.3.0/29
                    type: SECONDARY
              Add additional edge location:
                value:
                  ipProvider: SP
                  ipBlocks:
                  - edgeLocation: us-west-1
                    cidr:
                    - 12.2.2.0/26
                    type: SECONDARY
                  - edgeLocation: us-east-1
                    cidr:
                    - 12.3.3.0/26
                    type: SECONDARY
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Update IP Pool:
                  value:
                    data:
                      id: 7673a661-a98b-4202-b70a-8edc3934a3f5
                      ipBlocks:
                      - cidr:
                        - 21.58.2.0/29
                        displayName: Mexico Central
                        edgeLocation: mexico-central
                      ipProvider: SP
                      name: ip-pool-test
                      permittedActions: []
                      region: us-south1
                      state: NOT_STARTED
                      status: PENDING
                      tsgId: '1091039496'
                    requestId: 6eb154b3-5ac0-441c-a8e4-a092f5b5b588
        '500':
          description: Internal Error
        '400':
          description: Bad Request
      operationId: PutMtSp-interconnectInterconnectsBy_interconnectidIp-pool
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      tags:
      - IP Pool
      summary: Palo Alto Networks Get IP Address Address Pool
      description: View the current IP Address address configuration assigned to an Interconnect, including CIDR ranges and provider status. This provides visibility into the addressing scheme used at the edge for egress routing. Access this to verify that the correct SP-provided or public IP Address ranges are in effect. The data returned includes the IP Address pool ID, its provisioning state, and a list of all active CIDR blocks.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '698769'
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Get IP Pool by id:
                  value:
                    data:
                      cloudProvider: AWS
                      createTime: 1748207866258
                      id: 64753c22-8234-4d06-8410-2fc7a949a8f5
                      interconnectId: 424f9837-68b3-11f0-92e9-4201ac16024e
                      ipBlocks:
                      - cidr:
                        - 18.2.1.0/28
                        displayName: US Northwest
                        edgeLocation: us-west-2
                        type: SECONDARY
                      ipProvider: SP
                      permittedActions:
                      - ASSIGN_IP_POOL
                      - DELETE_IP_POOL
                      - UPDATE_IP_POOL
                      state: NOT_STARTED
                      status: PENDING
                      updateTime: 1748207866258
                    requestId: 7d7de6bc-f96b-4cd7-bad4-fb7a5689eba7
        '400':
          description: Bad Request
      operationId: GetMtSp-interconnectInterconnectsBy_interconnectidIp-pool
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      tags:
      - IP Pool
      summary: Palo Alto Networks Delete IP Address Pool
      description: Remove all IP Address block associations and provider settings from the specified Interconnect. Terminating the pool stops the use of specific CIDRs for routing and returns the container to an unassigned state. Use this when retiring BYOIP ranges or preparing to swap service provider IP Address schemes. Note that deleting an active pool will immediately impact egress traffic relying on those addresses.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '525495'
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Delete IP Pool by id:
                  value:
                    data: IP Pool successfully deleted
                    requestId: e34443d5-dfbd-482b-a76c-5d753034efc0
      operationId: DeleteMtSp-interconnectInterconnectsBy_interconnectidIp-pool
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      tags:
      - IP Pool
      summary: Palo Alto Networks Create New Pool
      description: Provision and attach a new IP Address address pool to an existing Interconnect. This defines the addressing model (SP-provided or PANW-provided) that Prisma Access traffic will use at the edge. Use this when finalizing the egress setup for a new regional Interconnect container. When using SP-provided pools, you must include at least one valid public CIDR block mapped to a supported edge location.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '614590'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IPPoolRequest'
            examples:
              Create SP provided IP Pool:
                value:
                  ipProvider: SP
                  ipBlocks:
                  - edgeLocation: us-west-1
                    cidr:
                    - 12.2.2.0/26
                    type: SECONDARY
                  - edgeLocation: us-west2
                    cidr:
                    - 12.1.2.0/26
                    type: PRIMARY
              Create PANW provided IP Pool:
                value:
                  ipProvider: PANW
              Create AWS IP Pool:
                value:
                  ipProvider: SP
                  ipBlocks:
                  - edgeLocation: us-east-1a
                    cidr:
                    - 18.2.1.0/28
                    - 18.2.2.0/28
                    type: SECONDARY
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              examples:
                Add an IP Pool:
                  value:
                    data:
                      cloudProvider: GCP
                      createTime: 1758577740021
                      id: 3dec9dea-c100-495b-9fb2-16b44c1eae3a
                      interconnectId: 1689a56a-9386-40b5-aa9a-0cebad2650d8
                      ipBlocks:
                      - cidr:
                        - 12.2.2.0/26
                        displayName: US West
                        edgeLocation: us-west-1
                        type: SECONDARY
                      - cidr:
                        - 12.1.2.0/26
                        edgeLocation: us-west2
                        type: PRIMARY
                      ipProvider: SP
                      permittedActions: []
                      state: VALIDATING_CIDR_IN_ORCHESTRATOR
                      status: IN_PROGRESS
                      updateTime: 1758577740331
                    requestId: 8c085ae4-bf26-4de5-86bd-2ba446b65d47
        '400':
          description: Bad Request
          content:
            application/json:
              examples:
                CIDR already used:
                  value:
                    error:
                      errorCode: 52070
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: CIDR is already used
                    requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
                Private IP not allowed:
                  value:
                    error:
                      errorCode: 52068
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: CIDR in IP Pool is private IP, only public IPs allowed
                    requestId: b2c3d4e5-6f78-9012-bcde-f12345678901
                Max CIDRs reached:
                  value:
                    error:
                      errorCode: 52071
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Only ten cidr blocks allowed per edge location
                    requestId: c3d4e5f6-7890-1234-cdef-012345678901
                IP Pool already exists:
                  value:
                    error:
                      errorCode: 52013
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: IP Pool already exists in interconnect
                    requestId: d4e5f678-9012-3456-def0-123456789012
                Invalid CIDR range for GCP:
                  value:
                    error:
                      errorCode: 52123
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: GCP CloudProvider IP Block CIDRs must be between /25 to /29
                    requestId: e5f67890-1234-5678-ef01-234567890123
        '500':
          description: Internal Error
      operationId: PostMtSp-interconnectInterconnectsBy_interconnectidIp-pool
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    IPBlockType:
      type: string
      enum:
      - PRIMARY
      - SECONDARY
    IPBlockEntry:
      type: object
      required:
      - cidr
      properties:
        edgeLocation:
          type: string
          example: example-edgeLocation
        cidr:
          type: array
          minItems: 1
          uniqueItems: true
          items:
            type: string
          example:
          - example-cidr_item
          - example-cidr_item
        type:
          $ref: '#/components/schemas/IPBlockType'
    IPProvider:
      type: string
      enum:
      - SP
      - PANW
    IPPoolRequest:
      type: object
      required:
      - ipProvider
      properties:
        ipBlocks:
          type: array
          uniqueItems: true
          items:
            $ref: '#/components/schemas/IPBlockEntry'
          example:
          - edgeLocation: example-edgeLocation
            cidr:
            - example-cidr_item
            type: SECONDARY
          - edgeLocation: example-edgeLocation
            cidr:
            - example-cidr_item
            - example-cidr_item
            type: PRIMARY
        ipProvider:
          $ref: '#/components/schemas/IPProvider'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.