openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend LANNetworks API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: LANNetworks
  description: LAN network configuration for defining local networks at SD-WAN sites.
paths:
  /sdwan/config/v1/sites/{site_id}/lan-networks:
    get:
      operationId: listSiteLANNetworks
      summary: Palo Alto Networks List LAN Networks at a Site
      description: Returns a list of LAN networks configured at the specified site. LAN networks define the local subnets and VLAN configurations served by the SD-WAN device at the site.
      tags:
      - LANNetworks
      parameters:
      - name: site_id
        in: path
        required: true
        description: Unique site identifier.
        schema:
          type: string
        example: '999561'
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: LAN networks returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/LANNetwork'
              examples:
                ListSiteLannetworks200Example:
                  summary: Default listSiteLANNetworks 200 response
                  x-microcks-default: true
                  value:
                    count: 152
                    items:
                    - id: example-id
                      name: Branch Agent 29
                      description: Malware activity violation traffic configured applied endpoint on blocked rule.
                      network: example-network
                      vlan_id: 1844
                      dhcp_enabled: false
                      site_id: '464822'
                      created_at: '2026-11-11T20:32:51Z'
                      updated_at: '2024-05-16T20:23:02Z'
                    - id: example-id
                      name: Branch Agent 29
                      description: Malware activity violation traffic configured applied endpoint on blocked rule.
                      network: example-network
                      vlan_id: 1844
                      dhcp_enabled: false
                      site_id: '464822'
                      created_at: '2026-11-11T20:32:51Z'
                      updated_at: '2024-05-16T20:23:02Z'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSiteLANNetwork
      summary: Palo Alto Networks Create a LAN Network at a Site
      description: Creates a new LAN network configuration at the specified site.
      tags:
      - LANNetworks
      parameters:
      - name: site_id
        in: path
        required: true
        description: Unique site identifier.
        schema:
          type: string
        example: '768166'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LANNetwork'
            examples:
              CreateSiteLannetworkRequestExample:
                summary: Default createSiteLANNetwork request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Agent 29
                  description: Malware activity violation traffic configured applied endpoint on blocked rule.
                  network: example-network
                  vlan_id: 1844
                  dhcp_enabled: false
                  site_id: '464822'
                  created_at: '2026-11-11T20:32:51Z'
                  updated_at: '2024-05-16T20:23:02Z'
      responses:
        '200':
          description: LAN network created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LANNetwork'
              examples:
                CreateSiteLannetwork200Example:
                  summary: Default createSiteLANNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Agent 29
                    description: Malware activity violation traffic configured applied endpoint on blocked rule.
                    network: example-network
                    vlan_id: 1844
                    dhcp_enabled: false
                    site_id: '464822'
                    created_at: '2026-11-11T20:32:51Z'
                    updated_at: '2024-05-16T20:23:02Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    LANNetwork:
      type: object
      required:
      - name
      - network
      properties:
        id:
          type: string
          description: Unique identifier for the LAN network.
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name of the LAN network.
          example: Branch Agent 29
        description:
          type: string
          example: Malware activity violation traffic configured applied endpoint on blocked rule.
        network:
          type: string
          description: Subnet CIDR for the LAN network (e.g., 192.168.1.0/24).
          example: example-network
        vlan_id:
          type: integer
          minimum: 1
          maximum: 4094
          description: VLAN identifier for this LAN network.
          example: 1844
        dhcp_enabled:
          type: boolean
          default: false
          description: Whether the ION device serves DHCP for this network.
          example: false
        site_id:
          type: string
          readOnly: true
          example: '464822'
        created_at:
          type: string
          format: date-time
          readOnly: true
          example: '2026-11-11T20:32:51Z'
        updated_at:
          type: string
          format: date-time
          readOnly: true
          example: '2024-05-16T20:23:02Z'
    ErrorResponse:
      type: object
      properties:
        _error:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation firewall on investigation blocked malware on on activity traffic.
          example:
          - code: example-code
            message: Traffic activity blocked incident activity alert rule alert firewall incident.
          - code: example-code
            message: Traffic policy on violation blocked Security investigation blocked rule on malware network.
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.