openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend IPSecTunnels API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: IPSecTunnels
  description: IPSec tunnel configuration for site-to-site VPN connectivity.
paths:
  /ipsec-tunnels:
    get:
      operationId: listIPSecTunnels
      summary: Palo Alto Networks List IPSec Tunnels
      description: Returns a list of IPSec tunnel configurations. IPSec tunnels use the IKE gateways to establish encrypted VPN connectivity between branch sites or data centers and Prisma Access.
      tags:
      - IPSecTunnels
      parameters:
      - name: folder
        in: query
        description: Filter by folder.
        schema:
          type: string
        example: example-folder
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 200
        example: 200
      responses:
        '200':
          description: IPSec tunnels returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IPSecTunnel'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListIpsecTunnels200Example:
                  summary: Default listIPSecTunnels 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Staging Firewall 42
                      auto_key:
                        ike_gateway:
                        - name: Corporate Firewall 77
                        ipsec_crypto_profile: HVAC Controller
                      tunnel_monitor:
                        enable: false
                        destination_ip: 10.26.144.251
                        proxy_id: '408309'
                      anti_replay: true
                      folder: example-folder
                    offset: 212
                    total: 309
                    limit: 181
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createIPSecTunnel
      summary: Palo Alto Networks Create an IPSec Tunnel
      description: Creates a new IPSec tunnel in the candidate configuration.
      tags:
      - IPSecTunnels
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the IPSec tunnel.
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IPSecTunnel'
            examples:
              CreateIpsecTunnelRequestExample:
                summary: Default createIPSecTunnel request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Staging Firewall 42
                  auto_key: &id001
                    ike_gateway:
                    - name: Corporate Firewall 77
                    ipsec_crypto_profile: HVAC Controller
                  tunnel_monitor: &id002
                    enable: false
                    destination_ip: 10.26.144.251
                    proxy_id: '408309'
                  anti_replay: true
                  folder: example-folder
      responses:
        '201':
          description: IPSec tunnel created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IPSecTunnel'
              examples:
                CreateIpsecTunnel201Example:
                  summary: Default createIPSecTunnel 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Staging Firewall 42
                    auto_key: *id001
                    tunnel_monitor: *id002
                    anti_replay: true
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /ipsec-tunnels/{id}:
    get:
      operationId: getIPSecTunnel
      summary: Palo Alto Networks Get an IPSec Tunnel
      description: Returns the configuration of a specific IPSec tunnel.
      tags:
      - IPSecTunnels
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IPSec tunnel identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IPSec tunnel returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IPSecTunnel'
              examples:
                GetIpsecTunnel200Example:
                  summary: Default getIPSecTunnel 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Staging Firewall 42
                    auto_key:
                      ike_gateway:
                      - name: Corporate Firewall 77
                      ipsec_crypto_profile: HVAC Controller
                    tunnel_monitor:
                      enable: false
                      destination_ip: 10.26.144.251
                      proxy_id: '408309'
                    anti_replay: true
                    folder: example-folder
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateIPSecTunnel
      summary: Palo Alto Networks Update an IPSec Tunnel
      description: Updates an existing IPSec tunnel in the candidate configuration.
      tags:
      - IPSecTunnels
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IPSec tunnel identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IPSecTunnel'
            examples:
              UpdateIpsecTunnelRequestExample:
                summary: Default updateIPSecTunnel request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Staging Firewall 42
                  auto_key: &id003
                    ike_gateway:
                    - name: Corporate Firewall 77
                    ipsec_crypto_profile: HVAC Controller
                  tunnel_monitor: &id004
                    enable: false
                    destination_ip: 10.26.144.251
                    proxy_id: '408309'
                  anti_replay: true
                  folder: example-folder
      responses:
        '200':
          description: IPSec tunnel updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IPSecTunnel'
              examples:
                UpdateIpsecTunnel200Example:
                  summary: Default updateIPSecTunnel 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Staging Firewall 42
                    auto_key: *id003
                    tunnel_monitor: *id004
                    anti_replay: true
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteIPSecTunnel
      summary: Palo Alto Networks Delete an IPSec Tunnel
      description: Deletes an IPSec tunnel from the candidate configuration.
      tags:
      - IPSecTunnels
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IPSec tunnel identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IPSec tunnel deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Alert malware configured threat rule network malware configured on.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Threat configured alert firewall violation monitoring traffic activity.
            details: {}
          - code: example-code
            message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network.
            details: {}
        _request_id:
          type: string
          example: '980164'
    IPSecTunnel:
      type: object
      required:
      - name
      - auto_key
      properties:
        id:
          type: string
          description: Unique identifier for the IPSec tunnel.
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name of the IPSec tunnel.
          example: Staging Firewall 42
        auto_key:
          type: object
          description: Auto-key IKE configuration for the tunnel.
          properties:
            ike_gateway:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: Name of the IKE gateway to use.
                    example: Production Agent 99
              example:
              - name: Branch Agent 66
              - name: Primary Agent 16
            ipsec_crypto_profile:
              type: string
              description: IPSec crypto profile name.
              example: IP Camera
          example:
            ike_gateway:
            - name: Corporate Firewall 77
            ipsec_crypto_profile: HVAC Controller
        tunnel_monitor:
          type: object
          properties:
            enable:
              type: boolean
              example: false
            destination_ip:
              type: string
              format: ipv4
              example: 10.93.88.181
            proxy_id:
              type: string
              example: '109061'
          example:
            enable: false
            destination_ip: 10.26.144.251
            proxy_id: '408309'
        anti_replay:
          type: boolean
          default: true
          description: Whether anti-replay protection is enabled.
          example: true
        folder:
          type: string
          readOnly: true
          example: example-folder
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.