openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend MobileAgent API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: MobileAgent
  description: Mobile user agent infrastructure settings for GlobalProtect remote user connectivity.
paths:
  /mobile-agent/infrastructure-settings:
    get:
      operationId: getMobileAgentInfrastructureSettings
      summary: Palo Alto Networks Get Mobile Agent Infrastructure Settings
      description: Returns the mobile user infrastructure settings for GlobalProtect agent connectivity. These settings define the Prisma Access compute locations, IP pool allocations, and portal configuration for remote mobile users.
      tags:
      - MobileAgent
      parameters:
      - name: folder
        in: query
        description: Filter by folder (e.g., Mobile Users).
        schema:
          type: string
        example: example-folder
      responses:
        '200':
          description: Mobile agent infrastructure settings returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MobileAgentInfrastructureSettings'
              examples:
                GetMobileAgentInfrastructureSettings200Example:
                  summary: Default getMobileAgentInfrastructureSettings 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 52
                    ip_pool:
                    - example-ip_pool_item
                    - example-ip_pool_item
                    dns_servers:
                    - example-dns_servers_item
                    dns_suffix:
                    - example-dns_suffix_item
                    regions:
                    - name: Production Firewall 52
                      addresses:
                      - example-addresses_item
                      - example-addresses_item
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createMobileAgentInfrastructureSettings
      summary: Palo Alto Networks Create Mobile Agent Infrastructure Settings
      description: Creates or updates the mobile user infrastructure settings in the candidate configuration. Changes must be pushed to take effect.
      tags:
      - MobileAgent
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MobileAgentInfrastructureSettings'
            examples:
              CreateMobileAgentInfrastructureSettingsRequestExample:
                summary: Default createMobileAgentInfrastructureSettings request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 52
                  ip_pool: &id001
                  - example-ip_pool_item
                  - example-ip_pool_item
                  dns_servers: &id002
                  - example-dns_servers_item
                  dns_suffix: &id003
                  - example-dns_suffix_item
                  regions: &id004
                  - name: Production Firewall 52
                    addresses:
                    - example-addresses_item
                    - example-addresses_item
      responses:
        '200':
          description: Mobile agent infrastructure settings saved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MobileAgentInfrastructureSettings'
              examples:
                CreateMobileAgentInfrastructureSettings200Example:
                  summary: Default createMobileAgentInfrastructureSettings 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 52
                    ip_pool: *id001
                    dns_servers: *id002
                    dns_suffix: *id003
                    regions: *id004
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    MobileAgentInfrastructureSettings:
      type: object
      properties:
        id:
          type: string
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name for the infrastructure settings configuration.
          example: Branch Sensor 52
        ip_pool:
          type: array
          items:
            type: string
          description: IP address pools for mobile user address allocation.
          example:
          - example-ip_pool_item
          - example-ip_pool_item
        dns_servers:
          type: array
          items:
            type: string
          description: DNS server IP addresses for mobile users.
          example:
          - example-dns_servers_item
        dns_suffix:
          type: array
          items:
            type: string
          description: DNS suffixes to append for mobile users.
          example:
          - example-dns_suffix_item
        regions:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
                description: Prisma Access compute region.
                example: Staging Gateway 93
              addresses:
                type: array
                items:
                  type: string
                description: IP addresses for the mobile user gateway in this region.
                example:
                - example-addresses_item
          description: Compute regions for mobile user connectivity.
          example:
          - name: Production Firewall 52
            addresses:
            - example-addresses_item
            - example-addresses_item
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Alert malware configured threat rule network malware configured on.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Threat configured alert firewall violation monitoring traffic activity.
            details: {}
          - code: example-code
            message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network.
            details: {}
        _request_id:
          type: string
          example: '980164'
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.