openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Licenses API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Licenses
  description: ZTNA license and entitlement information.
paths:
  /v2/licenses:
    get:
      operationId: getZTNALicenses
      summary: Palo Alto Networks Get ZTNA License Information
      description: Returns current ZTNA license entitlements including the number of licensed users, active users, and subscription expiration date.
      tags:
      - Licenses
      responses:
        '200':
          description: License information returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LicenseInfo'
              examples:
                GetZtnalicenses200Example:
                  summary: Default getZTNALicenses 200 response
                  x-microcks-default: true
                  value:
                    licensed_users: 279
                    active_users: 419
                    subscription_id: '360915'
                    expires_at: '2025-11-19T10:30:55Z'
                    features:
                    - example-features_item
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetZtnalicenses401Example:
                  summary: Default getZTNALicenses 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetZtnalicenses403Example:
                  summary: Default getZTNALicenses 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetZtnalicenses500Example:
                  summary: Default getZTNALicenses 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Security firewall network configured traffic blocked threat.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 709c60bb-8234-4bc4-938b-d0835224c350
    LicenseInfo:
      type: object
      properties:
        licensed_users:
          type: integer
          description: Total number of ZTNA user licenses purchased.
          example: 279
        active_users:
          type: integer
          description: Number of users actively using ZTNA.
          example: 419
        subscription_id:
          type: string
          description: Subscription identifier.
          example: '360915'
        expires_at:
          type: string
          format: date-time
          description: Subscription expiration date and time.
          example: '2025-11-19T10:30:55Z'
        features:
          type: array
          items:
            type: string
          description: List of enabled ZTNA feature entitlements.
          example:
          - example-features_item
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.