openapi: 3.2.0
info:
  contact: {}
  description: "Add and modify the user IAM rules and permission policies required to expand or reduce their access and permissions. You can also delete a user. And individual users can view their roles and change their name or password as necessary.\n\n### Permission Policies\n\n| Action                                     | Local Firewall Administrator  | Local Rulestack Administrator | Global Rulestack Administrator |\n| :----------------------------------------: | :---------------------------: | :--------------------------:  | :----------------------------: |\n| Create a Firewall Resource                 | **☑**                   | ☐                       | ☐                        |\n| Delete a Firewall Resource                 | **☑**                   | ☐                       | ☐                        |                        \n| Describe a Firewall Resource               | **☑**                   | **☑**                   | **☑**                    |  \n| List Firewall Resources                    | **☑**                   | **☑**                   | **☑**                    | \n| Update a Firewall Resource Description     | **☑**                   | ☐                       | ☐                        |                                         \n| Update a Firewall Content Version          | **☑**                   | ☐                       | ☐                        |                                           \n| Update a Firewall Resource Subnet Mappings | **☑**                   | ☐                       | ☐                        |                                     \n"
  title: Manage Cloud NGFW Manage NGFW API
  version: 1.0.0
servers:
- url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com
tags:
- name: ManageNGFW
paths:
  /v1/config/ngfirewalls:
    get:
      description: 'Retrieve all firewalls in the Global Firewall Admin (FMS) account along with their associated firewall policy metadata.

        '
      operationId: get-v1-config-ngfirewalls
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListFWResourceResponse'
          description: OK
      summary: List firewall resources
      tags:
      - ManageNGFW
    post:
      description: 'Create an AWS Network Firewall by specifying firewall policy, subnets in your VPC, and associated tags.

        '
      operationId: post-v1-config-ngfirewalls
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateFWResourceResponse'
          description: OK
      summary: Create firewall resource
      tags:
      - ManageNGFW
  /v1/config/ngfirewalls/{ngfirewallname}:
    delete:
      description: 'Delete the specified NGFW. Verify the NGFW is not in use by reviewing route tables for Availability Zones where NGFW subnet mappings exist. Update route tables to remove NGFW endpoints before deletion.

        '
      operationId: delete-v1-config-ngfirewalls-ngfirewallname
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteFWResourceResponse'
          description: OK
      summary: Delete firewall resource
      tags:
      - ManageNGFW
    get:
      description: 'Retrieve the configuration data for a specific NGFW resource.

        '
      operationId: get-v1-config-ngfirewalls-ngfirewallname
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReadFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadFWResourceResponse'
          description: OK
      summary: Retrieve firewall resource
      tags:
      - ManageNGFW
  /v1/config/ngfirewalls/{ngfirewallname}/description:
    put:
      description: 'Modify the description of a specific NGFW to help identify the firewall during management operations.

        '
      operationId: put-v1-config-ngfirewalls-ngfirewallname-description
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFWResourceDescriptionRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateFWResourceDescriptionResponse'
          description: OK
      summary: Update firewall description
      tags:
      - ManageNGFW
  /v1/config/ngfirewalls/{ngfirewallname}/subnets:
    put:
      description: 'Update the subnet IDs associated with an NGFW.

        '
      operationId: put-v1-config-ngfirewalls-ngfirewallname-subnets
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFWResourceSubnetsRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateFWResourceSubnetsResponse'
          description: OK
      summary: Update subnet mappings
      tags:
      - ManageNGFW
components:
  schemas:
    ListFWResourceResponse.FirewallInfo:
      properties:
        AccountId:
          title: Accountid
          type: string
        FirewallName:
          title: Firewallname
          type: string
      required:
      - FirewallName
      title: FirewallInfo
      type: object
    DeleteFWResourceResponse.FirewallResource:
      properties:
        AccountId:
          title: Accountid
          type: string
        AppIdVersion:
          maxLength: 64
          minLength: 1
          pattern: ^[0-9]+-[0-9]+$
          title: Appidversion
          type: string
        AutomaticUpgradeAppIdVersion:
          default: true
          title: Automaticupgradeappidversion
          type: boolean
        Description:
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        Tags:
          items:
            type: object
          title: Tags
          type: array
        UpdateToken:
          default: '1'
          title: Updatetoken
          type: string
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: FirewallResource
      type: object
    ListFWResourceResponse.ResponseData:
      properties:
        Firewalls:
          items:
            $ref: '#/components/schemas/ListFWResourceResponse.FirewallInfo'
          title: Firewalls
          type: array
        NextToken:
          title: Nexttoken
          type: string
      title: ResponseData
      type: object
    ListFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    DeleteFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    ReadFWResourceResponse.ResourceStatus:
      properties:
        Attachments:
          items:
            $ref: '#/components/schemas/ReadFWResourceResponse.ResourceAttachment'
          title: Attachments
          type: array
        FailureReason:
          title: Failurereason
          type: string
        FirewallStatus:
          enum:
          - CREATING
          - UPDATING
          - DELETING
          - CREATE_COMPLETE
          - UPDATE_COMPLETE
          - CREATE_FAIL
          - UPDATE_FAIL
          - DELETE_FAIL
          title: Firewallstatus
          type: string
        RuleStackStatus:
          title: Rulestackstatus
          type: string
      required:
      - Attachments
      - FirewallStatus
      title: ResourceStatus
      type: object
    DeleteFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/DeleteFWResourceResponse.FirewallResource'
        ResponseStatus:
          $ref: '#/components/schemas/DeleteFWResourceResponse.Result'
      title: DeleteFWResourceResponse
      type: object
    CreateFWResourceResponse.FirewallResource:
      properties:
        AccountId:
          title: Accountid
          type: string
        AppIdVersion:
          maxLength: 64
          minLength: 1
          pattern: ^[0-9]+-[0-9]+$
          title: Appidversion
          type: string
        AutomaticUpgradeAppIdVersion:
          default: true
          title: Automaticupgradeappidversion
          type: boolean
        Description:
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        Tags:
          items:
            type: object
          title: Tags
          type: array
        UpdateToken:
          default: '1'
          title: Updatetoken
          type: string
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: FirewallResource
      type: object
    ReadFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    CreateFWResourceRequest.SubnetMappingsType:
      additionalProperties: false
      properties:
        AvailabilityZone:
          title: Availabilityzone
          type: string
        SubnetId:
          title: Subnetid
          type: string
      title: SubnetMappingsType
      type: object
    UpdateFWResourceSubnetsRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        AssociateSubnetMappings:
          items:
            $ref: '#/components/schemas/UpdateFWResourceSubnetsRequest.SubnetMappingsType'
          title: Associatesubnetmappings
          type: array
        DisassociateSubnetMappings:
          items:
            $ref: '#/components/schemas/UpdateFWResourceSubnetsRequest.SubnetMappingsType'
          title: Disassociatesubnetmappings
          type: array
        UpdateToken:
          title: Updatetoken
          type: string
      title: UpdateFWResourceSubnetsRequest
      type: object
    CreateFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    ReadFWResourceResponse.ReadFirewallResource:
      properties:
        AccountId:
          title: Accountid
          type: string
        AppIdVersion:
          maxLength: 64
          minLength: 1
          pattern: ^[0-9]+-[0-9]+$
          title: Appidversion
          type: string
        AutomaticUpgradeAppIdVersion:
          default: true
          title: Automaticupgradeappidversion
          type: boolean
        Description:
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        EndpointServiceName:
          default: Creating
          title: Endpointservicename
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        Tags:
          items:
            type: object
          title: Tags
          type: array
        UpdateToken:
          default: '1'
          title: Updatetoken
          type: string
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: ReadFirewallResource
      type: object
    UpdateFWResourceSubnetsResponse:
      properties:
        Response:
          $ref: '#/components/schemas/UpdateFWResourceSubnetsResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/UpdateFWResourceSubnetsResponse.Result'
      title: UpdateFWResourceSubnetsResponse
      type: object
    UpdateFWResourceDescriptionResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    ListFWResourceRequest:
      additionalProperties: false
      properties:
        MaxResults:
          default: 1024
          maximum: 1024
          minimum: 1
          title: Maxresults
          type: integer
        NextToken:
          maxLength: 2048
          minLength: 1
          pattern: ^[-0-9A-Za-z:\/+=]+$
          title: Nexttoken
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        VpcIds:
          items:
            type: string
          title: Vpcids
          type: array
      title: ListFWResourceRequest
      type: object
    UpdateFWResourceDescriptionResponse:
      properties:
        Response:
          $ref: '#/components/schemas/UpdateFWResourceDescriptionResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/UpdateFWResourceDescriptionResponse.Result'
      title: UpdateFWResourceDescriptionResponse
      type: object
    CreateFWResourceRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        Description:
          maxLength: 512
          pattern: ^.*$
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            $ref: '#/components/schemas/CreateFWResourceRequest.SubnetMappingsType'
          title: Subnetmappings
          type: array
        Tags:
          items:
            $ref: '#/components/schemas/CreateFWResourceRequest.TagEntry'
          maxItems: 50
          title: Tags
          type: array
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: CreateFWResourceRequest
      type: object
    UpdateFWResourceDescriptionResponse.ResponseData:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        Description:
          title: Description
          type: string
        FirewallName:
          title: Firewallname
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      title: ResponseData
      type: object
    UpdateFWResourceSubnetsResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    UpdateFWResourceSubnetsResponse.ResponseData:
      properties:
        AccountId:
          title: Accountid
          type: string
        FirewallName:
          title: Firewallname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        UpdateToken:
          title: Updatetoken
          type: string
      title: ResponseData
      type: object
    UpdateFWResourceSubnetsRequest.SubnetMappingsType:
      additionalProperties: false
      properties:
        AvailabilityZone:
          title: Availabilityzone
          type: string
        SubnetId:
          title: Subnetid
          type: string
      title: SubnetMappingsType
      type: object
    ReadFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/ReadFWResourceResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/ReadFWResourceResponse.Result'
      title: ReadFWResourceResponse
      type: object
    ReadFWResourceRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
      title: ReadFWResourceRequest
      type: object
    ReadFWResourceResponse.ResponseData:
      properties:
        Firewall:
          $ref: '#/components/schemas/ReadFWResourceResponse.ReadFirewallResource'
        Status:
          $ref: '#/components/schemas/ReadFWResourceResponse.ResourceStatus'
      title: ResponseData
      type: object
    DeleteFWResourceRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
      title: DeleteFWResourceRequest
      type: object
    CreateFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/CreateFWResourceResponse.FirewallResource'
        ResponseStatus:
          $ref: '#/components/schemas/CreateFWResourceResponse.Result'
      title: CreateFWResourceResponse
      type: object
    ReadFWResourceResponse.ResourceAttachment:
      properties:
        EndpointId:
          title: Endpointid
          type: string
        RejectedReason:
          title: Rejectedreason
          type: string
        Status:
          enum:
          - ACCEPTED
          - PENDING
          - REJECTED
          title: Status
          type: string
        SubnetId:
          title: Subnetid
          type: string
      required:
      - EndpointId
      - Status
      title: ResourceAttachment
      type: object
    ListFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/ListFWResourceResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/ListFWResourceResponse.Result'
      title: ListFWResourceResponse
      type: object
    CreateFWResourceRequest.TagEntry:
      additionalProperties: false
      properties:
        Key:
          title: Key
          type: string
        Value:
          title: Value
          type: string
      required:
      - Key
      - Value
      title: TagEntry
      type: object
    UpdateFWResourceDescriptionRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        Description:
          maxLength: 512
          pattern: ^.*$
          title: Description
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      required:
      - Description
      title: UpdateFWResourceDescriptionRequest
      type: object