openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Objects API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Objects
  description: Address objects, address groups, service objects, service groups, and tag management.
paths:
  /Objects/Addresses:
    get:
      operationId: listAddresses
      summary: Palo Alto Networks List Address Objects
      description: Returns all address objects configured on the firewall. Supports filtering by name and location (vsys, device group, or shared). Address objects define IP addresses, IP ranges, IP subnets, or FQDNs used in security policy rules.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by address object name.
        schema:
          type: string
        example: Production Firewall 09
      responses:
        '200':
          description: Address objects returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                    example: success
                  '@code':
                    type: string
                    example: '19'
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Address'
              examples:
                ListAddresses200Example:
                  summary: Default listAddresses 200 response
                  x-microcks-default: true
                  value:
                    '@status': success
                    '@code': '19'
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Production Firewall 76
                        ip-netmask: example-ip-netmask
                        ip-range: example-ip-range
                        ip-wildcard: example-ip-wildcard
                        fqdn: api.acme-systems.org
                        description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                        tag: &id001
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Production Firewall 76
                        ip-netmask: example-ip-netmask
                        ip-range: example-ip-range
                        ip-wildcard: example-ip-wildcard
                        fqdn: api.acme-systems.org
                        description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                        tag: *id001
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddress
      summary: Palo Alto Networks Create Address Object
      description: Creates a new address object on the firewall. The address object can be of type ip-netmask, ip-range, ip-wildcard, or fqdn. The object must have a unique name within the specified location scope. Changes are staged in candidate configuration until committed.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to create.
        schema:
          type: string
        example: Staging Policy 66
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Address'
            examples:
              CreateAddressRequestExample:
                summary: Default createAddress request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Firewall 76
                    ip-netmask: example-ip-netmask
                    ip-range: example-ip-range
                    ip-wildcard: example-ip-wildcard
                    fqdn: api.acme-systems.org
                    description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateAddress200Example:
                  summary: Default createAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          description: Address object with the specified name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAddress409Example:
                  summary: Default createAddress 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg:
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddress
      summary: Palo Alto Networks Update Address Object
      description: Updates an existing address object identified by name. The entire object definition must be provided in the request body as this performs a full replacement of the address object configuration.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to update.
        schema:
          type: string
        example: Branch Agent 74
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Address'
            examples:
              UpdateAddressRequestExample:
                summary: Default updateAddress request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Firewall 76
                    ip-netmask: example-ip-netmask
                    ip-range: example-ip-range
                    ip-wildcard: example-ip-wildcard
                    fqdn: api.acme-systems.org
                    description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateAddress200Example:
                  summary: Default updateAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddress
      summary: Palo Alto Networks Delete Address Object
      description: Deletes an address object identified by name. The object cannot be deleted if it is referenced by an active security policy rule or address group. Remove all references before deleting.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to delete.
        schema:
          type: string
        example: Production Agent 38
      responses:
        '200':
          description: Address object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteAddress200Example:
                  summary: Default deleteAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Object is referenced by other configuration elements.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAddress409Example:
                  summary: Default deleteAddress 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg:
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/AddressGroups:
    get:
      operationId: listAddressGroups
      summary: Palo Alto Networks List Address Groups
      description: Returns all address groups configured on the firewall. Address groups contain address objects or other address groups and can be static (explicit member list) or dynamic (tag-based membership criteria).
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by address group name.
        schema:
          type: string
        example: Corporate Sensor 37
      responses:
        '200':
          description: Address groups returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/AddressGroup'
              examples:
                ListAddressGroups200Example:
                  summary: Default listAddressGroups 200 response
                  x-microcks-default: true
                  value:
                    '@status': enabled
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Branch Agent 57
                        static: &id002
                          member:
                          - example-member_item
                        dynamic: &id003
                          filter: example-filter
                        description: Policy alert detected violation network network violation suspicious on malware network.
                        tag: &id004
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Branch Agent 57
                        static: *id002
                        dynamic: *id003
                        description: Policy alert detected violation network network violation suspicious on malware network.
                        tag: *id004
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddressGroup
      summary: Palo Alto Networks Create Address Group
      description: Creates a new address group. The group can be static with an explicit list of member address objects, or dynamic with a tag-based filter expression that automatically includes matching address objects.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to create.
        schema:
          type: string
        example: Primary Policy 55
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/AddressGroup'
            examples:
              CreateAddressGroupRequestExample:
                summary: Default createAddressGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Agent 57
                    static:
                      member:
                      - example-member_item
                    dynamic:
                      filter: example-filter
                    description: Policy alert detected violation network network violation suspicious on malware network.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateAddressGroup200Example:
                  summary: Default createAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          description: Address group with the specified name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAddressGroup409Example:
                  summary: Default createAddressGroup 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg:
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddressGroup
      summary: Palo Alto Networks Update Address Group
      description: Updates an existing address group identified by name. The entire group definition must be provided as this performs a full replacement.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to update.
        schema:
          type: string
        example: Branch Agent 78
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/AddressGroup'
            examples:
              UpdateAddressGroupRequestExample:
                summary: Default updateAddressGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Agent 57
                    static:
                      member:
                      - example-member_item
                    dynamic:
                      filter: example-filter
                    description: Policy alert detected violation network network violation suspicious on malware network.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateAddressGroup200Example:
                  summary: Default updateAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddressGroup
      summary: Palo Alto Networks Delete Address Group
      description: Deletes an address group identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to delete.
        schema:
          type: string
        example: Primary Gateway 21
      responses:
        '200':
          description: Address group deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteAddressGroup200Example:
                  summary: Default deleteAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/Services:
    get:
      operationId: listServices
      summary: Palo Alto Networks List Service Objects
      description: Returns all service objects configured on the firewall. Service objects define TCP or UDP protocol and port combinations used in security policy rules to identify specific network services.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by service object name.
        schema:
          type: string
        example: Primary Gateway 90
      responses:
        '200':
          description: Service objects returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Service'
              examples:
                ListServices200Example:
                  summary: Default listServices 200 response
                  x-microcks-default: true
                  value:
                    '@status': active
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Staging Firewall 44
                        protocol: &id005
                          tcp:
                            port: example-port
                            source-port: example-source-port
                          udp:
                            port: example-port
                            source-port: example-source-port
                        description: On endpoint traffic rule alert blocked.
                        tag: &id006
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Staging Firewall 44
                        protocol: *id005
                        description: On endpoint traffic rule alert blocked.
                        tag: *id006
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createService
      summary: Palo Alto Networks Create Service Object
      description: Creates a new service object defining a TCP or UDP protocol with destination port or port range.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to create.
        schema:
          type: string
        example: Corporate Sensor 55
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Service'
            examples:
              CreateServiceRequestExample:
                summary: Default createService request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Firewall 44
                    protocol:
                      tcp:
                        port: example-port
                        source-port: example-source-port
                      udp:
                        port: example-port
                        source-port: example-source-port
                    description: On endpoint traffic rule alert blocked.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Service object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateService200Example:
                  summary: Default createService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateService
      summary: Palo Alto Networks Update Service Object
      description: Updates an existing service object identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to update.
        schema:
          type: string
        example: Branch Gateway 83
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Service'
            examples:
              UpdateServiceRequestExample:
                summary: Default updateService request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Firewall 44
                    protocol:
                      tcp:
                        port: example-port
                        source-port: example-source-port
                      udp:
                        port: example-port
                        source-port: example-source-port
                    description: On endpoint traffic rule alert blocked.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Service object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateService200Example:
                  summary: Default updateService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteService
      summary: Palo Alto Networks Delete Service Object
      description: Deletes a service object identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to delete.
        schema:
          type: string
        example: Staging Agent 83
      responses:
        '200':
          description: Service object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteService200Example:
                  summary: Default deleteService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/ServiceGroups:
    get:
      operationId: listServiceGroups
      summary: Palo Alto Networks List Service Groups
      description: Returns all service groups configured on the firewall. Service groups aggregate multiple service objects for use in security policy rules.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by service group name.
        schema:
          type: string
        example: Corporate Sensor 06
      responses:
        '200':
          description: Service groups returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/ServiceGroup'
              examples:
                ListServiceGroups200Example:
                  summary: Default listServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    '@status': active
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Primary Policy 84
                        members: &id007
                          member:
                          - example-member_item
                          - example-member_item
                        tag: &id008
                          member:
                          - example-member_item
                      - '@name': Primary Policy 84
                        members: *id007
                        tag: *id008
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createServiceGroup
      summary: Palo Alto Networks Create Service Group
      description: Creates a new service group containing one or more service objects.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service group to create.
        schema:
          type: string
        example: Staging Policy 14
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/ServiceGroup'
            examples:
              CreateServiceGroupRequestExample:
                summary: Default createServiceGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Primary Policy 84
                    members:
                      member:
                      - example-member_item
                      - example-member_item
                    tag:
                      member:
                      - example-member_item
      responses:
        '200':
          description: Service group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateServiceGroup200Example:
                  summary: Default createServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateServiceGroup
      summary: Palo Alto Networks Update Service Group
      description: Updates an existing service group identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service group to update.
        schema:
          type: string
        example: Staging Firewall 58
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/ServiceGroup'
            examples:
              UpdateServiceGroupRequestExample:
                summary: Default updateServiceGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Primary Policy 84
                    members:
                      member:
                      - example-member_item
                      - example-member_item
                    tag:
                      member:
                      - example-member_item
      responses:
        '200':
          description: Service group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateServiceGroup200Example:
                  summary: Default updateServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteServiceGroup
      summary: Palo Alto Networks Delete Service Group
      description: Deletes a service group identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service group to delete.
        schema:
          type: string
        example: Staging Agent 80
      responses:
        '200':
          description: Service group deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteServiceGroup200Example:
                  summary: Default deleteServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/Tags:
    get:
      operationId: listTags
      summary: Palo Alto Networks List Tags
      description: Returns all tag objects configured on the firewall. Tags are used to categorize address objects and other configuration elements for use in dynamic address groups and policy filtering.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by tag name.
        schema:
          type: string
        example: Staging Agent 58
      responses:
        '200':
          description: Tags returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Tag'
              examples:
                ListTags200Example:
                  summary: Default listTags 200 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Production Policy 97
                        color: example-color
                        comments: On alert endpoint firewall activity detected suspicious.
                      - '@name': Production Policy 97
                        color: example-color
                        comments: On alert endpoint firewall activity detected suspicious.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createTag
      summary: Palo Alto Networks Create Tag
      description: Creates a new tag object with optional color and comment. Tags are applied to address objects, security rules, and other elements to enable dynamic grouping and filtering.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the tag to create.
        schema:
          type: string
        example: Primary Agent 93
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Tag'
            examples:
              CreateTagRequestExample:
                summary: Default createTag request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Policy 97
                    color: example-color
                    comments: On alert endpoint firewall activity detected suspicious.
      responses:
        '200':
          description: Tag created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateTag200Example:
                  summary: Default createTag 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateTag
      summary: Palo Alto Networks Update Tag
      description: Updates an existing tag identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the tag to update.
        schema:
          type: string
        example: Primary Sensor 38
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Tag'
            examples:
              UpdateTagRequestExample:
                summary: Default updateTag request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Policy 97
                    color: example-color
                    comments: On alert endpoint firewall activity detected suspicious.
      responses:
        '200':
          description: Tag updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateTag200Example:
                  summary: Default updateTag 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteTag
      summary: Palo Alto Networks Delete Tag
      description: Deletes a tag identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the tag to delete.
        schema:
          type: string
        example: Staging Policy 49
      responses:
        '200':
          description: Tag deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteTag200Example:
                  summary: Default deleteTag 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  parameters:
    location:
      name: location
      in: query
      description: Configuration location scope.
      schema:
        type: string
        enum:
        - vsys
        - device-group
        - shared
        default: vsys
    vsys:
      name: vsys
      in: query
      description: Virtual system name when location is vsys.
      schema:
        type: string
        default: vsys1
  schemas:
    PanOsResponse:
      type: object
      description: Standard PAN-OS API response envelope.
      properties:
        '@status':
          type: string
          enum:
          - success
          - error
          example: error
        '@code':
          type: string
          example: example-@code
        msg:
          type: string
          example: example-msg
    ServiceGroup:
      type: object
      description: A group of service objects for use in security policy rules.
      properties:
        '@name':
          type: string
          description: Unique name of the service group.
          example: Primary Policy 84
        members:
          type: object
          properties:
            member:
              type: array
              items:
                type: string
              description: List of service object names.
              example:
              - example-member_item
              - example-member_item
          example:
            member:
            - example-member_item
            - example-member_item
        tag:
          type: object
          properties:
            member:
              type: array
              items:
                type: string
              example:
              - example-member_item
          example:
            member:
            - example-member_item
    Tag:
      type: object
      description: A tag for categorizing configuration objects.
      properties:
        '@name':
          type: string
          description: Unique name of the tag.
          example: Production Policy 97
        color:
          type: string
          description: Display color for the tag (e.g., color1, color2).
          example: example-color
        comments:
          type: string
          description: Description or comments for the tag.
          example: On alert endpoint firewall activity detected suspicious.
    Service:
      type: object
      description: A service object defining a TCP or UDP protocol with destination port or port range.
      properties:
        '@name':
          type: string
          description: Unique name of the service object.
          example: Staging Firewall 44
        protocol:
          type: object
          properties:
            tcp:
              type: object
              properties:
                port:
                  type: string
                  description: TCP destination port or range (e.g., 80, 8080-8090).
                  example: example-port
                source-port:
                  type: string
                  description: TCP source port or range.
                  example: example-source-port
              example:
                port: example-port
                source-port: example-source-port
            udp:
              type: object
              properties:
                port:
                  type: string
                  description: UDP destination port or range (e.g., 53, 500-502).
                  example: example-port
                source-port:
                  type: string
                  description: UDP source port or range.
                  example: example-source-port
              example:
                port: example-port
                source-port: example-source-port
          example:
            tcp:
              port: example-port
              source-port: example-source-port
            udp:
              port: example-port
              source-port: example-source-port
        description:
          type: string
          example: On endpoint traffic rule alert blocked.
        tag:
          type: object
          properties:
            member:
              type: array
              items:
                type: string
              example:
              - example-member_item
              - example-member_item
          example:
            member:
            - example-member_item
            - example-member_item
    Address:
      type: object
      description: An address object representing an IP address, subnet, range, wildcard mask, or FQDN used in security policy rules.
      properties:
        '@name':
          type: string
          description: Unique name of the address object.
          example: Production Firewall 76
        ip-netmask:
          type: string
          description: IP address with CIDR netmask (e.g., 10.0.0.0/24).
          example: example-ip-netmask
        ip-range:
          type: string
          description: IP address range (e.g., 10.0.0.1-10.0.0.254).
          example: example-ip-range
        ip-wildcard:
          type: string
          description: IP wildcard mask (e.g., 10.20.1.0/0.0.248.255).
          example: example-ip-wildcard
        fqdn:
          type: string
          description: Fully qualified domain name (e.g., www.example.com).
          example: api.acme-systems.org
        description:
          type: string
          description: Description of the address object.
          example: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
        tag:
          type: object
          properties:
            member:
              type: array
              items:
                type: string
              description: Tags assigned to this address object.
              example:
              - example-member_item
          example:
            member:
            - example-member_item
            - example-member_item
    ErrorResponse:
      type: object
      properties:
        '@status':
          type: string
          example: running
        '@code':
          type: string
          example: example-@code
        msg:
          type: object
          properties:
            line:
              type: string
              description: Error message detail.
              example: example-line
          example:
            line: example-line
    AddressGroup:
      type: object
      description: A group of address objects. Can be static with an explicit member list or dynamic with a tag-based filter expression.
      properties:
        '@name':
          type: string
          description: Unique name of the address group.
          example: Branch Agent 57
        static:
          type: object
          description: Static address group with explicit members.
          properties:
            member:
              type: array
              items:
                type: string
              description: List of address object names.
              example:
              - example-member_item
              - example-member_item
          example:
            member:
            - example-member_item
        dynamic:
          type: object
          description: Dynamic address group with tag-based filter.
          properties:
            filter:
              type: string
              description: Tag-based filter expression (e.g., "'web-servers' and 'production'").
              example: example-filter
          example:
            filter: example-filter
        description:
          type: string
          example: Policy alert detected violation network network violation suspicious on malware network.
        tag:
          type: object
          properties:
            member:
              type: array
              items:
                type: string
              example:
              - example-member_item
              - example-member_item
          example:
            member:
            - example-member_item
            - example-member_item
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: An internal server error occurred.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.