openapi: 3.1.0 info: title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Policy Group Lifecycle Endpoints API description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform. version: '1.0' contact: name: Palo Alto Networks Developer Support url: https://pan.dev/ license: name: Proprietary url: https://www.paloaltonetworks.com/legal servers: - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1 description: AIOps for NGFW BPA API production server. security: - oauth2Bearer: [] tags: - name: Policy Group Lifecycle Endpoints description: 'APIs to interact with the MSSP Backend Service # Authentication ' paths: /api/v1/mssp/{mssp-id}/policy-group/{pg-id}: get: tags: - Policy Group Lifecycle Endpoints summary: Palo Alto Networks Get the Details of an Existing Policy Group description: Returns the details of an existing policy group. Will use msspId from the auth token if available. operationId: get-policy-group-by-id parameters: - name: pg-id in: path description: the id of the policy group required: true schema: type: string format: uuid example: 34e2e197-f172-4a04-93a4-39b1532648ab - name: mssp-id in: path description: the mssp the policy group belongs to required: true schema: type: string example: e91b486a-e139-4d3b-a9dd-959fd5cffb10 responses: '200': description: OK content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/PolicyGroupResponse' examples: Get-Policy-Group-By-Id200Example: summary: Default get-policy-group-by-id 200 response x-microcks-default: true value: id: 289a717e-8053-4e21-b5be-23f1918a1628 name: Production Agent 76 policies: - example-policies_item tenantGroups: - id: ad7141fc-7249-4085-ba81-89c7dce06beb tenantGroupId: 016e80c2-a77b-43b9-8892-71848159488e tenantGroupName: Branch Policy 91 tenantCount: 729 '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-Policy-Group-By-Id400Example: summary: Default get-policy-group-by-id 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-Policy-Group-By-Id401Example: summary: Default get-policy-group-by-id 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-Policy-Group-By-Id403Example: summary: Default get-policy-group-by-id 403 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-Policy-Group-By-Id429Example: summary: Default get-policy-group-by-id 429 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK put: tags: - Policy Group Lifecycle Endpoints summary: Palo Alto Networks Update a Policy Group description: Updates a policy group if it doesn't exist. Will use msspId from the auth token if available. operationId: update-policy-group parameters: - name: pg-id in: path description: the id of the policy group required: true schema: type: string format: uuid example: 34e2e197-f172-4a04-93a4-39b1532648ab - name: mssp-id in: path description: the mssp the tenant group belongs to required: true schema: type: string example: e91b486a-e139-4d3b-a9dd-959fd5cffb10 requestBody: content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/PolicyGroupRequest' examples: Update-Policy-GroupRequestExample: summary: Default update-policy-group request x-microcks-default: true value: name: Production Agent 45 policies: - example-policies_item required: true responses: '204': description: Update Accepted '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Update-Policy-Group400Example: summary: Default update-policy-group 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Update-Policy-Group401Example: summary: Default update-policy-group 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Update-Policy-Group403Example: summary: Default update-policy-group 403 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Update-Policy-Group429Example: summary: Default update-policy-group 429 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: tags: - Policy Group Lifecycle Endpoints summary: Palo Alto Networks Delete an Existing Policy Group description: Deletes a policy group if it is empty. Will use msspId from the auth token if available. operationId: delete-policy-group parameters: - name: pg-id in: path description: the id of the policy group required: true schema: type: string format: uuid example: 34e2e197-f172-4a04-93a4-39b1532648ab - name: mssp-id in: path description: the mssp the policy group belongs to required: true schema: type: string example: e91b486a-e139-4d3b-a9dd-959fd5cffb10 responses: '204': description: Delete Accepted headers: Location: description: The relative path to the deleted policy group style: simple schema: type: string '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Delete-Policy-Group400Example: summary: Default delete-policy-group 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Delete-Policy-Group401Example: summary: Default delete-policy-group 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Delete-Policy-Group403Example: summary: Default delete-policy-group 403 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Delete-Policy-Group429Example: summary: Default delete-policy-group 429 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v1/mssp/{mssp-id}/policy-group: get: tags: - Policy Group Lifecycle Endpoints summary: Palo Alto Networks Get the Details of All Existing Policy Groups description: Returns the details of all existing policy groups. Will use msspId from the auth token if available. operationId: get-all-policy-groups parameters: - name: mssp-id in: path description: the mssp the policy group belongs to required: true schema: type: string example: e91b486a-e139-4d3b-a9dd-959fd5cffb10 - name: next_page_token in: query description: pagination token to continue a previous query required: false schema: type: string example: example-next_page_token responses: '200': description: OK content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/PolicyGroupsListResponse' examples: Get-All-Policy-Groups200Example: summary: Default get-all-policy-groups 200 response x-microcks-default: true value: value: - id: 87eb394e-a31f-4802-9c0c-90060f936459 name: Staging Sensor 65 policyCount: 601 tenantGroupCount: 617 - id: 87eb394e-a31f-4802-9c0c-90060f936459 name: Staging Sensor 65 policyCount: 601 tenantGroupCount: 617 nextPageToken: example-nextPageToken '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-All-Policy-Groups400Example: summary: Default get-all-policy-groups 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-All-Policy-Groups401Example: summary: Default get-all-policy-groups 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-All-Policy-Groups403Example: summary: Default get-all-policy-groups 403 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Get-All-Policy-Groups429Example: summary: Default get-all-policy-groups 429 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK post: tags: - Policy Group Lifecycle Endpoints summary: Palo Alto Networks Create a Policy Group description: Creates a policy group if it doesn't exist. Will use msspId from the auth token if available. operationId: create-policy-group parameters: - name: mssp-id in: path description: the mssp the tenant group belongs to required: true schema: type: string example: e91b486a-e139-4d3b-a9dd-959fd5cffb10 requestBody: content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/PolicyGroupRequest' examples: Create-Policy-GroupRequestExample: summary: Default create-policy-group request x-microcks-default: true value: name: Production Agent 45 policies: - example-policies_item required: true responses: '201': description: Created headers: Location: description: The relative path to the created policy group style: simple schema: type: string content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/CreatePolicyGroupResponse' examples: Create-Policy-Group201Example: summary: Default create-policy-group 201 response x-microcks-default: true value: id: 7b13785c-32f1-4969-8a6e-d8fc9f6c6acd name: Staging Agent 12 policies: - example-policies_item '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Create-Policy-Group400Example: summary: Default create-policy-group 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Create-Policy-Group401Example: summary: Default create-policy-group 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Create-Policy-Group403Example: summary: Default create-policy-group 403 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Create-Policy-Group409Example: summary: Default create-policy-group 409 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: Create-Policy-Group429Example: summary: Default create-policy-group 429 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: PolicyGroupResponse: type: object properties: id: type: string format: uuid example: 289a717e-8053-4e21-b5be-23f1918a1628 name: type: string example: Production Agent 76 policies: type: array items: type: string example: - example-policies_item tenantGroups: type: array items: $ref: '#/components/schemas/TenantGroupMappingDetails' example: - id: ad7141fc-7249-4085-ba81-89c7dce06beb tenantGroupId: 016e80c2-a77b-43b9-8892-71848159488e tenantGroupName: Branch Policy 91 tenantCount: 729 TenantGroupMappingDetails: type: object properties: id: type: string format: uuid example: 76ac47ff-a974-4764-8b56-a6fbf64aecb9 tenantGroupId: type: string format: uuid example: 27542068-18f9-4a68-9f7f-ebe5bf91a1dd tenantGroupName: type: string example: Branch Agent 07 tenantCount: type: integer format: int32 example: 171 ErrorResponse: required: - error type: object properties: error: $ref: '#/components/schemas/Error' CreatePolicyGroupResponse: type: object properties: id: type: string format: uuid example: 7b13785c-32f1-4969-8a6e-d8fc9f6c6acd name: maxLength: 63 minLength: 3 type: string example: Staging Agent 12 policies: type: array items: type: string example: - example-policies_item Error: required: - code - message type: object properties: code: type: string example: example-code message: type: string example: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: type: string example: example-target details: type: array items: $ref: '#/components/schemas/Error' example: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} PolicyGroupRequest: required: - name type: object properties: name: maxLength: 63 minLength: 3 type: string description: Name of the policy group. example: Production Agent 45 policies: type: array description: Policies assigned to this policy group. items: type: string description: Policies assigned to this policy group. example: - example-policies_item PolicyGroupListResponse: type: object properties: id: type: string format: uuid example: 87eb394e-a31f-4802-9c0c-90060f936459 name: type: string example: Staging Sensor 65 policyCount: type: integer format: int32 example: 601 tenantGroupCount: type: integer format: int32 example: 617 PolicyGroupsListResponse: type: object properties: value: type: array items: $ref: '#/components/schemas/PolicyGroupListResponse' example: - id: 87eb394e-a31f-4802-9c0c-90060f936459 name: Staging Sensor 65 policyCount: 601 tenantGroupCount: 617 - id: 87eb394e-a31f-4802-9c0c-90060f936459 name: Staging Sensor 65 policyCount: 601 tenantGroupCount: 617 nextPageToken: type: string example: example-nextPageToken securitySchemes: oauth2Bearer: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.