openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend PathRules API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: PathRules
  description: Path policy rule management for controlling traffic steering decisions across available WAN links.
paths:
  /sdwan/config/v1/policies/path-rules:
    get:
      operationId: listPathRules
      summary: Palo Alto Networks List Path Policy Rules
      description: Returns a list of path policy rules. Path rules control traffic steering decisions across available WAN links based on application identity, source, destination, and link quality conditions.
      tags:
      - PathRules
      parameters:
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: Path policy rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/PathRule'
              examples:
                ListPathRules200Example:
                  summary: Default listPathRules 200 response
                  x-microcks-default: true
                  value:
                    count: 207
                    items:
                    - id: example-id
                      name: Branch Sensor 65
                      description: Alert suspicious incident policy rule detected investigation malware rule suspicious traffic applied.
                      app_filters:
                      - example-app_filters_item
                      - example-app_filters_item
                      preferred_paths:
                      - label: Primary Sensor 13
                        type: active
                      - label: Branch Agent 67
                        type: backup
                      sla_threshold:
                        latency_ms: 949
                        packet_loss_pct: 91.65
                        jitter_ms: 547
                      enabled: true
                      priority: 446
                      created_at: '2025-11-26T11:25:53Z'
                      updated_at: '2025-12-01T02:58:26Z'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createPathRule
      summary: Palo Alto Networks Create a Path Policy Rule
      description: Creates a new path policy rule for traffic steering.
      tags:
      - PathRules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PathRule'
            examples:
              CreatePathRuleRequestExample:
                summary: Default createPathRule request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 65
                  description: Alert suspicious incident policy rule detected investigation malware rule suspicious traffic applied.
                  app_filters: &id001
                  - example-app_filters_item
                  - example-app_filters_item
                  preferred_paths: &id002
                  - label: Primary Sensor 13
                    type: active
                  - label: Branch Agent 67
                    type: backup
                  sla_threshold: &id003
                    latency_ms: 949
                    packet_loss_pct: 91.65
                    jitter_ms: 547
                  enabled: true
                  priority: 446
                  created_at: '2025-11-26T11:25:53Z'
                  updated_at: '2025-12-01T02:58:26Z'
      responses:
        '200':
          description: Path policy rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PathRule'
              examples:
                CreatePathRule200Example:
                  summary: Default createPathRule 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 65
                    description: Alert suspicious incident policy rule detected investigation malware rule suspicious traffic applied.
                    app_filters: *id001
                    preferred_paths: *id002
                    sla_threshold: *id003
                    enabled: true
                    priority: 446
                    created_at: '2025-11-26T11:25:53Z'
                    updated_at: '2025-12-01T02:58:26Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    PathRule:
      type: object
      required:
      - name
      properties:
        id:
          type: string
          description: Unique identifier for the path rule.
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name of the path rule.
          example: Branch Sensor 65
        description:
          type: string
          example: Alert suspicious incident policy rule detected investigation malware rule suspicious traffic applied.
        app_filters:
          type: array
          items:
            type: string
          description: Application identifiers this path rule applies to.
          example:
          - example-app_filters_item
          - example-app_filters_item
        preferred_paths:
          type: array
          items:
            type: object
            properties:
              label:
                type: string
                description: WAN interface label for the preferred path.
                example: Production Agent 68
              type:
                type: string
                enum:
                - active
                - backup
                description: Whether this path is active or backup.
                example: active
          description: Ordered list of preferred WAN paths for traffic steering.
          example:
          - label: Primary Sensor 13
            type: active
          - label: Branch Agent 67
            type: backup
        sla_threshold:
          type: object
          description: SLA thresholds that trigger path switching.
          properties:
            latency_ms:
              type: integer
              description: Maximum acceptable latency in milliseconds.
              example: 703
            packet_loss_pct:
              type: number
              description: Maximum acceptable packet loss percentage.
              example: 12.38
            jitter_ms:
              type: integer
              description: Maximum acceptable jitter in milliseconds.
              example: 2
          example:
            latency_ms: 949
            packet_loss_pct: 91.65
            jitter_ms: 547
        enabled:
          type: boolean
          default: true
          description: Whether the rule is active.
          example: true
        priority:
          type: integer
          description: Rule evaluation priority. Lower numbers are evaluated first.
          example: 446
        created_at:
          type: string
          format: date-time
          readOnly: true
          example: '2025-11-26T11:25:53Z'
        updated_at:
          type: string
          format: date-time
          readOnly: true
          example: '2025-12-01T02:58:26Z'
    ErrorResponse:
      type: object
      properties:
        _error:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation firewall on investigation blocked malware on on activity traffic.
          example:
          - code: example-code
            message: Traffic activity blocked incident activity alert rule alert firewall incident.
          - code: example-code
            message: Traffic policy on violation blocked Security investigation blocked rule on malware network.
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.