openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend MSSP Account Management API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: MSSP Account Management
paths:
  /api/v1/mssp/{mssp-id}/tos:
    post:
      tags:
      - MSSP Account Management
      summary: Palo Alto Networks Terms of Service
      description: Endpoint used to accept terms of service.
      operationId: tosAcceptance
      parameters:
      - name: mssp-id
        in: path
        description: The id of the MSSP of interest
        required: true
        schema:
          type: string
        example: '457996'
      responses:
        '204':
          description: Successful operation
        '400':
          description: Bad request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                TosAcceptance400Example:
                  summary: Default tosAcceptance 400 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '401':
          description: Authentication error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                TosAcceptance401Example:
                  summary: Default tosAcceptance 401 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '429':
          description: Rate limiting error
      security:
      - UserJwt: []
      x-public: 'true'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v1/mssp/{mssp-id}:
    get:
      tags:
      - MSSP Account Management
      summary: Palo Alto Networks Get the Details of an Existing MSSP
      description: Returns the details of an existing MSSP account
      operationId: getMssp
      parameters:
      - name: mssp-id
        in: path
        description: the id of the MSSP of interest
        required: true
        schema:
          type: string
        example: '818522'
      responses:
        '200':
          description: OK
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/MsspResponse'
              examples:
                GetMssp200Example:
                  summary: Default getMssp 200 response
                  x-microcks-default: true
                  value:
                    msspId: '963068'
                    name: Corporate Gateway 26
                    createdBy: example-createdBy
                    createdAt: 414
                    customerSupportId: '670106'
                    contactInfo:
                      firstName: Branch Sensor 70
                      lastName: Staging Policy 31
                      email: analyst1@example.com
        '404':
          description: The MSSP does not exist
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetMssp404Example:
                  summary: Default getMssp 404 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '429':
          description: Rate limiting error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetMssp429Example:
                  summary: Default getMssp 429 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
      security:
      - UserJwt: []
      x-public: 'true'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v1/mssp/{mssp-id}/operation:
    get:
      tags:
      - MSSP Account Management
      summary: Palo Alto Networks Get the Operation List for an MSSP
      description: Gets the list of operations for an MSSP.
      operationId: getMsspOperations
      parameters:
      - name: mssp-id
        in: path
        description: the id of the MSSP of interest
        required: true
        schema:
          type: string
        example: '249425'
      - name: status
        in: query
        description: optional filter by status, accepts "success", "failure", "in_progress"
        required: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
            enum:
            - IN_PROGRESS
            - SUCCESS
            - FAILURE
        example:
        - IN_PROGRESS
        - FAILURE
      - name: show_retried
        in: query
        description: optional boolean filter to show retried operations, defaults to false
        required: false
        schema:
          type: boolean
          default: false
        example: false
      - name: nextPageToken
        in: query
        description: pagination token to continue a previous query
        required: false
        schema:
          type: string
        example: example-nextPageToken
      responses:
        '200':
          description: OK
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/OperationsResponse'
              examples:
                GetMsspOperations200Example:
                  summary: Default getMsspOperations 200 response
                  x-microcks-default: true
                  value:
                    value:
                    - requestId: 4b0348d5-573c-4efd-a630-8b03814c6b3c
                      msspId: e63fa3c6-95a4-4aeb-98f7-e9aa00a7558b
                      operationType: MESSAGE_FAN_OUT
                      operationName: POLICY_MAP
                      operationDescription: Incident incident configured investigation malware violation incident applied applied on network.
                      status: FAILURE
                      tenantChanges:
                      - tenantChangeId: 018cb8f2-d5f2-43b8-9571-f38716ffe3d2
                        externalTenantId: '426227'
                        tenantPrismaId: '519160'
                        status: IN_PROGRESS
                        updatedAt: 73
                      startedBy: example-startedBy
                      startedAt: 93
                      updatedAt: 375
                      isRetryable: true
                      retryOf: 5716ecaa-0bb9-4bf6-ae8d-f2afdc9dc153
                      retriedBy: 3ea1e71a-2068-4b42-91ea-859717617763
                    - requestId: 4b0348d5-573c-4efd-a630-8b03814c6b3c
                      msspId: e63fa3c6-95a4-4aeb-98f7-e9aa00a7558b
                      operationType: MESSAGE_FAN_OUT
                      operationName: POLICY_MAP
                      operationDescription: Incident incident configured investigation malware violation incident applied applied on network.
                      status: FAILURE
                      tenantChanges:
                      - tenantChangeId: 018cb8f2-d5f2-43b8-9571-f38716ffe3d2
                        externalTenantId: '426227'
                        tenantPrismaId: '519160'
                        status: IN_PROGRESS
                        updatedAt: 73
                      startedBy: example-startedBy
                      startedAt: 93
                      updatedAt: 375
                      isRetryable: true
                      retryOf: 5716ecaa-0bb9-4bf6-ae8d-f2afdc9dc153
                      retriedBy: 3ea1e71a-2068-4b42-91ea-859717617763
                    nextPageToken: example-nextPageToken
        '404':
          description: The MSSP does not exist
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetMsspOperations404Example:
                  summary: Default getMsspOperations 404 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '429':
          description: Rate limiting error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetMsspOperations429Example:
                  summary: Default getMsspOperations 429 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
      security:
      - UserJwt: []
      x-public: 'true'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v1/mssp/{mssp-id}/license-pool:
    get:
      tags:
      - MSSP Account Management
      summary: Palo Alto Networks Get the License Pool Details of an Existing MSSP
      description: Returns the details of an existing MSSP.
      operationId: getMsspLicensePools
      parameters:
      - name: mssp-id
        in: path
        description: the id of the MSSP of interest
        required: true
        schema:
          type: string
        example: '827871'
      responses:
        '200':
          description: OK
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/MsspLicensePoolsResponse'
              examples:
                GetMsspLicensePools200Example:
                  summary: Default getMsspLicensePools 200 response
                  x-microcks-default: true
                  value:
                    value:
                    - licensePoolId: '791432'
                      poolName: Branch Firewall 14
                      serialNumber: example-serialNumber
                      msspId: '652019'
                      totalCredits: 749
                      unallocatedCredits: 827
                      startDate: 649
                      endDate: 939
                      tenantLicenses:
                      - tenantLicenseId: '109663'
                        serialNumber: example-serialNumber
                        licensePoolId: '997200'
                        allocatedCredits: 456
                        startDate: 589
                        endDate: 255
                    - licensePoolId: '791432'
                      poolName: Branch Firewall 14
                      serialNumber: example-serialNumber
                      msspId: '652019'
                      totalCredits: 749
                      unallocatedCredits: 827
                      startDate: 649
                      endDate: 939
                      tenantLicenses:
                      - tenantLicenseId: '109663'
                        serialNumber: example-serialNumber
                        licensePoolId: '997200'
                        allocatedCredits: 456
                        startDate: 589
                        endDate: 255
                    nextPageToken: example-nextPageToken
        '404':
          description: The MSSP does not exist
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetMsspLicensePools404Example:
                  summary: Default getMsspLicensePools 404 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '429':
          description: Rate limiting error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetMsspLicensePools429Example:
                  summary: Default getMsspLicensePools 429 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
      security:
      - UserJwt: []
      x-public: 'true'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ContactInfo:
      required:
      - email
      - firstName
      - lastName
      type: object
      properties:
        firstName:
          maxLength: 63
          minLength: 1
          type: string
          example: Branch Sensor 70
        lastName:
          maxLength: 63
          minLength: 1
          type: string
          example: Staging Policy 31
        email:
          maxLength: 128
          minLength: 1
          type: string
          example: analyst1@example.com
    MsspLicensePoolResponse:
      type: object
      properties:
        licensePoolId:
          type: string
          example: '791432'
        poolName:
          type: string
          example: Branch Firewall 14
        serialNumber:
          type: string
          example: example-serialNumber
        msspId:
          type: string
          example: '652019'
        totalCredits:
          type: integer
          format: int32
          example: 749
        unallocatedCredits:
          type: integer
          format: int32
          example: 827
        startDate:
          type: integer
          format: int64
          example: 649
        endDate:
          type: integer
          format: int64
          example: 939
        tenantLicenses:
          type: array
          items:
            $ref: '#/components/schemas/ManagedTenantLicenseResponse'
          example:
          - tenantLicenseId: '109663'
            serialNumber: example-serialNumber
            licensePoolId: '997200'
            allocatedCredits: 456
            startDate: 589
            endDate: 255
    TenantChangeResponse:
      type: object
      properties:
        tenantChangeId:
          type: string
          format: uuid
          example: 21506922-dae2-4e8a-879f-b738126b7a2d
        externalTenantId:
          type: string
          example: '833084'
        tenantPrismaId:
          type: string
          example: '169016'
        status:
          type: string
          enum:
          - IN_PROGRESS
          - SUCCESS
          - FAILURE
          example: SUCCESS
        updatedAt:
          type: integer
          format: int64
          example: 131
    ManagedTenantLicenseResponse:
      type: object
      properties:
        tenantLicenseId:
          type: string
          example: '109663'
        serialNumber:
          type: string
          example: example-serialNumber
        licensePoolId:
          type: string
          example: '997200'
        allocatedCredits:
          type: integer
          format: int32
          example: 456
        startDate:
          type: integer
          format: int64
          example: 589
        endDate:
          type: integer
          format: int64
          example: 255
    Error:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          example: example-code
        message:
          type: string
          example: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
        target:
          type: string
          example: example-target
        details:
          type: array
          items:
            $ref: '#/components/schemas/Error'
          example:
          - code: example-code
            message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
            target: example-target
            details:
            - code: example-code
              message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
              target: example-target
              details:
              - {}
              - {}
            - code: example-code
              message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
              target: example-target
              details:
              - {}
              - {}
    OperationResponse:
      type: object
      properties:
        requestId:
          type: string
          format: uuid
          example: 4b0348d5-573c-4efd-a630-8b03814c6b3c
        msspId:
          type: string
          format: uuid
          example: e63fa3c6-95a4-4aeb-98f7-e9aa00a7558b
        operationType:
          type: string
          enum:
          - MESSAGE_FAN_OUT
          - ORCHESTRATOR_REQUEST
          example: MESSAGE_FAN_OUT
        operationName:
          type: string
          enum:
          - PROVISION_TENANT
          - UPDATE_TENANT
          - DELETE_TENANT
          - OFFBOARD_TENANT
          - REPLICATE_ACTION
          - CREATE_USER
          - UPDATE_USER
          - DELETE_USER
          - POLICY_MAP
          - POLICY_UNMAP
          - SYNC_POLICIES
          example: POLICY_MAP
        operationDescription:
          type: string
          example: Incident incident configured investigation malware violation incident applied applied on network.
        status:
          type: string
          enum:
          - IN_PROGRESS
          - SUCCESS
          - FAILURE
          example: FAILURE
        tenantChanges:
          type: array
          items:
            $ref: '#/components/schemas/TenantChangeResponse'
          example:
          - tenantChangeId: 018cb8f2-d5f2-43b8-9571-f38716ffe3d2
            externalTenantId: '426227'
            tenantPrismaId: '519160'
            status: IN_PROGRESS
            updatedAt: 73
        startedBy:
          type: string
          example: example-startedBy
        startedAt:
          type: integer
          format: int64
          example: 93
        updatedAt:
          type: integer
          format: int64
          example: 375
        isRetryable:
          type: boolean
          example: true
        retryOf:
          type: string
          format: uuid
          example: 5716ecaa-0bb9-4bf6-ae8d-f2afdc9dc153
        retriedBy:
          type: string
          format: uuid
          example: 3ea1e71a-2068-4b42-91ea-859717617763
    MsspResponse:
      type: object
      properties:
        msspId:
          type: string
          example: '963068'
        name:
          type: string
          example: Corporate Gateway 26
        createdBy:
          type: string
          example: example-createdBy
        createdAt:
          type: integer
          format: int64
          example: 414
        customerSupportId:
          type: string
          example: '670106'
        contactInfo:
          $ref: '#/components/schemas/ContactInfo'
    ErrorResponse:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
    MsspLicensePoolsResponse:
      type: object
      properties:
        value:
          type: array
          items:
            $ref: '#/components/schemas/MsspLicensePoolResponse'
          example:
          - licensePoolId: '791432'
            poolName: Branch Firewall 14
            serialNumber: example-serialNumber
            msspId: '652019'
            totalCredits: 749
            unallocatedCredits: 827
            startDate: 649
            endDate: 939
            tenantLicenses:
            - tenantLicenseId: '109663'
              serialNumber: example-serialNumber
              licensePoolId: '997200'
              allocatedCredits: 456
              startDate: 589
              endDate: 255
          - licensePoolId: '791432'
            poolName: Branch Firewall 14
            serialNumber: example-serialNumber
            msspId: '652019'
            totalCredits: 749
            unallocatedCredits: 827
            startDate: 649
            endDate: 939
            tenantLicenses:
            - tenantLicenseId: '109663'
              serialNumber: example-serialNumber
              licensePoolId: '997200'
              allocatedCredits: 456
              startDate: 589
              endDate: 255
        nextPageToken:
          type: string
          example: example-nextPageToken
    OperationsResponse:
      type: object
      properties:
        value:
          type: array
          items:
            $ref: '#/components/schemas/OperationResponse'
          example:
          - requestId: 4b0348d5-573c-4efd-a630-8b03814c6b3c
            msspId: e63fa3c6-95a4-4aeb-98f7-e9aa00a7558b
            operationType: MESSAGE_FAN_OUT
            operationName: POLICY_MAP
            operationDescription: Incident incident configured investigation malware violation incident applied applied on network.
            status: FAILURE
            tenantChanges:
            - tenantChangeId: 018cb8f2-d5f2-43b8-9571-f38716ffe3d2
              externalTenantId: '426227'
              tenantPrismaId: '519160'
              status: IN_PROGRESS
              updatedAt: 73
            startedBy: example-startedBy
            startedAt: 93
            updatedAt: 375
            isRetryable: true
            retryOf: 5716ecaa-0bb9-4bf6-ae8d-f2afdc9dc153
            retriedBy: 3ea1e71a-2068-4b42-91ea-859717617763
          - requestId: 4b0348d5-573c-4efd-a630-8b03814c6b3c
            msspId: e63fa3c6-95a4-4aeb-98f7-e9aa00a7558b
            operationType: MESSAGE_FAN_OUT
            operationName: POLICY_MAP
            operationDescription: Incident incident configured investigation malware violation incident applied applied on network.
            status: FAILURE
            tenantChanges:
            - tenantChangeId: 018cb8f2-d5f2-43b8-9571-f38716ffe3d2
              externalTenantId: '426227'
              tenantPrismaId: '519160'
              status: IN_PROGRESS
              updatedAt: 73
            startedBy: example-startedBy
            startedAt: 93
            updatedAt: 375
            isRetryable: true
            retryOf: 5716ecaa-0bb9-4bf6-ae8d-f2afdc9dc153
            retriedBy: 3ea1e71a-2068-4b42-91ea-859717617763
        nextPageToken:
          type: string
          example: example-nextPageToken
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.