openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend NATRules API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: NATRules
  description: NAT policy rule management.
paths:
  /sse/config/v1/nat-rules:
    get:
      operationId: listNatRules
      summary: Palo Alto Networks List NAT Rules
      description: Returns a paginated list of NAT rules in the specified scope. NAT rules define source and destination address translation policies.
      tags:
      - NATRules
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      - $ref: '#/components/parameters/position'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: name
        in: query
        description: Filter by NAT rule name.
        schema:
          type: string
        example: Primary Sensor 79
      responses:
        '200':
          description: NAT rules returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NatRuleList'
              examples:
                ListNatRules200Example:
                  summary: Default listNatRules 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: c0e38509-af62-4dd8-98d7-f4b3d68d793e
                      name: Primary Sensor 71
                      folder: example-folder
                      position: post
                      from:
                      - example-from_item
                      to:
                      - example-to_item
                      source:
                      - example-source_item
                      destination:
                      - example-destination_item
                      service: example-service
                      source_translation:
                        dynamic_ip_and_port:
                          translated_address:
                          - example-translated_address_item
                        static_ip:
                          translated_address: example-translated_address
                          bi_directional: false
                      destination_translation:
                        translated_address: example-translated_address
                        translated_port: 475
                      nat_type: nptv6
                      disabled: false
                      description: Detected firewall applied network alert violation suspicious investigation.
                      tag:
                      - critical-asset
                    offset: 459
                    total: 479
                    limit: 624
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createNatRule
      summary: Palo Alto Networks Create NAT Rule
      description: Creates a new NAT rule in the specified folder or snippet.
      tags:
      - NATRules
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      - $ref: '#/components/parameters/position'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NatRuleRequest'
            examples:
              CreateNatRuleRequestExample:
                summary: Default createNatRule request
                x-microcks-default: true
                value:
                  name: Production Agent 98
                  from:
                  - example-from_item
                  to:
                  - example-to_item
                  - example-to_item
                  source:
                  - example-source_item
                  - example-source_item
                  destination:
                  - example-destination_item
                  - example-destination_item
                  service: example-service
                  source_translation:
                    dynamic_ip_and_port:
                      translated_address:
                      - example-translated_address_item
                      - example-translated_address_item
                    static_ip:
                      translated_address: example-translated_address
                      bi_directional: true
                  destination_translation:
                    translated_address: example-translated_address
                    translated_port: 210
                  disabled: false
                  description: Activity violation Security firewall applied violation investigation suspicious blocked activity.
                  tag:
                  - pci-scope
      responses:
        '201':
          description: NAT rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NatRule'
              examples:
                CreateNatRule201Example:
                  summary: Default createNatRule 201 response
                  x-microcks-default: true
                  value:
                    id: c0e38509-af62-4dd8-98d7-f4b3d68d793e
                    name: Primary Sensor 71
                    folder: example-folder
                    position: post
                    from:
                    - example-from_item
                    to:
                    - example-to_item
                    source:
                    - example-source_item
                    destination:
                    - example-destination_item
                    service: example-service
                    source_translation:
                      dynamic_ip_and_port:
                        translated_address:
                        - example-translated_address_item
                      static_ip:
                        translated_address: example-translated_address
                        bi_directional: false
                    destination_translation:
                      translated_address: example-translated_address
                      translated_port: 475
                    nat_type: nptv6
                    disabled: false
                    description: Detected firewall applied network alert violation suspicious investigation.
                    tag:
                    - critical-asset
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    NatRule:
      type: object
      description: A NAT policy rule defining source or destination address translation for matching traffic flows.
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: c0e38509-af62-4dd8-98d7-f4b3d68d793e
        name:
          type: string
          example: Primary Sensor 71
        folder:
          type: string
          readOnly: true
          example: example-folder
        position:
          type: string
          enum:
          - pre
          - post
          example: post
        from:
          type: array
          items:
            type: string
          description: Source zones.
          example:
          - example-from_item
        to:
          type: array
          items:
            type: string
          description: Destination zones.
          example:
          - example-to_item
        source:
          type: array
          items:
            type: string
          example:
          - example-source_item
        destination:
          type: array
          items:
            type: string
          example:
          - example-destination_item
        service:
          type: string
          description: Service object name or any.
          example: example-service
        source_translation:
          type: object
          properties:
            dynamic_ip_and_port:
              type: object
              properties:
                translated_address:
                  type: array
                  items:
                    type: string
                  example:
                  - example-translated_address_item
              example:
                translated_address:
                - example-translated_address_item
                - example-translated_address_item
            static_ip:
              type: object
              properties:
                translated_address:
                  type: string
                  example: example-translated_address
                bi_directional:
                  type: boolean
                  example: true
              example:
                translated_address: example-translated_address
                bi_directional: false
          example:
            dynamic_ip_and_port:
              translated_address:
              - example-translated_address_item
            static_ip:
              translated_address: example-translated_address
              bi_directional: false
        destination_translation:
          type: object
          properties:
            translated_address:
              type: string
              example: example-translated_address
            translated_port:
              type: integer
              example: 447
          example:
            translated_address: example-translated_address
            translated_port: 475
        nat_type:
          type: string
          enum:
          - ipv4
          - nat64
          - nptv6
          example: nptv6
        disabled:
          type: boolean
          default: false
          example: false
        description:
          type: string
          example: Detected firewall applied network alert violation suspicious investigation.
        tag:
          type: array
          items:
            type: string
          example:
          - critical-asset
    NatRuleList:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/NatRule'
          example:
          - id: c0e38509-af62-4dd8-98d7-f4b3d68d793e
            name: Primary Sensor 71
            folder: example-folder
            position: post
            from:
            - example-from_item
            to:
            - example-to_item
            source:
            - example-source_item
            destination:
            - example-destination_item
            service: example-service
            source_translation:
              dynamic_ip_and_port:
                translated_address:
                - example-translated_address_item
              static_ip:
                translated_address: example-translated_address
                bi_directional: false
            destination_translation:
              translated_address: example-translated_address
              translated_port: 475
            nat_type: nptv6
            disabled: false
            description: Detected firewall applied network alert violation suspicious investigation.
            tag:
            - critical-asset
        offset:
          type: integer
          example: 459
        total:
          type: integer
          example: 479
        limit:
          type: integer
          example: 624
    NatRuleRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          example: Production Agent 98
        from:
          type: array
          items:
            type: string
          example:
          - example-from_item
        to:
          type: array
          items:
            type: string
          example:
          - example-to_item
          - example-to_item
        source:
          type: array
          items:
            type: string
          example:
          - example-source_item
          - example-source_item
        destination:
          type: array
          items:
            type: string
          example:
          - example-destination_item
          - example-destination_item
        service:
          type: string
          example: example-service
        source_translation:
          type: object
          properties:
            dynamic_ip_and_port:
              type: object
              properties:
                translated_address:
                  type: array
                  items:
                    type: string
                  example:
                  - example-translated_address_item
                  - example-translated_address_item
              example:
                translated_address:
                - example-translated_address_item
                - example-translated_address_item
            static_ip:
              type: object
              properties:
                translated_address:
                  type: string
                  example: example-translated_address
                bi_directional:
                  type: boolean
                  example: false
              example:
                translated_address: example-translated_address
                bi_directional: false
          example:
            dynamic_ip_and_port:
              translated_address:
              - example-translated_address_item
              - example-translated_address_item
            static_ip:
              translated_address: example-translated_address
              bi_directional: true
        destination_translation:
          type: object
          properties:
            translated_address:
              type: string
              example: example-translated_address
            translated_port:
              type: integer
              example: 897
          example:
            translated_address: example-translated_address
            translated_port: 210
        disabled:
          type: boolean
          example: false
        description:
          type: string
          example: Activity violation Security firewall applied violation investigation suspicious blocked activity.
        tag:
          type: array
          items:
            type: string
          example:
          - pci-scope
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security monitoring rule configured endpoint on network blocked.
            details: {}
          - code: example-code
            message: Security on on threat monitoring activity policy.
            details: {}
        _request_id:
          type: string
          description: Unique request identifier for troubleshooting.
          example: '574499'
  parameters:
    snippet:
      name: snippet
      in: query
      description: Configuration snippet name.
      schema:
        type: string
    folder:
      name: folder
      in: query
      description: Configuration folder scope (e.g., Shared, Mobile Users, Remote Networks, Service Connections).
      schema:
        type: string
    offset:
      name: offset
      in: query
      description: Pagination offset (number of records to skip).
      schema:
        type: integer
        default: 0
    device:
      name: device
      in: query
      description: Device name for device-scoped configuration.
      schema:
        type: string
    position:
      name: position
      in: query
      description: Rulebase position filter.
      schema:
        type: string
        enum:
        - pre
        - post
    limit:
      name: limit
      in: query
      description: Maximum number of results per page.
      schema:
        type: integer
        default: 200
        maximum: 5000
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or the resource cannot be modified due to existing references.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.