openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Profiles API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Profiles
  description: Retrieve AI security profiles that define which detection categories are enabled, sensitivity thresholds, and actions to take when threats are detected.
paths:
  /v1/profile:
    get:
      operationId: listAIProfiles
      summary: Palo Alto Networks List AI Security Profiles
      description: Returns all AI security profiles configured for the tenant. Security profiles define which detection categories are active, their sensitivity levels, and the enforcement action to take when a threat is detected. Every scan request references a profile by name to determine evaluation behavior.
      tags:
      - Profiles
      parameters:
      - name: offset
        in: query
        description: Pagination offset for the result set.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of profiles to return per page.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: List of AI security profiles returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of profiles available for the tenant.
                  offset:
                    type: integer
                    description: Current pagination offset.
                  limit:
                    type: integer
                    description: Number of results per page.
                  profiles:
                    type: array
                    items:
                      $ref: '#/components/schemas/AIProfile'
              examples:
                ListAiprofiles200Example:
                  summary: Default listAIProfiles 200 response
                  x-microcks-default: true
                  value:
                    total: 305
                    offset: 518
                    limit: 600
                    profiles:
                    - profile_id: '701673'
                      profile_name: Corporate Agent 92
                      description: Rule on network suspicious configured activity firewall monitoring Security rule.
                      detection_categories: &id001
                      - category: pii_exposure
                        enabled: true
                        sensitivity: high
                        action: log
                      - category: toxic_content
                        enabled: false
                        sensitivity: low
                        action: alert
                      created_at: '2024-07-23T00:36:00Z'
                      updated_at: '2025-08-22T07:28:11Z'
                    - profile_id: '701673'
                      profile_name: Corporate Agent 92
                      description: Rule on network suspicious configured activity firewall monitoring Security rule.
                      detection_categories: *id001
                      created_at: '2024-07-23T00:36:00Z'
                      updated_at: '2025-08-22T07:28:11Z'
        '401':
          description: Invalid or missing x-pan-token API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAiprofiles401Example:
                  summary: Default listAIProfiles 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAiprofiles403Example:
                  summary: Default listAIProfiles 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAiprofiles500Example:
                  summary: Default listAIProfiles 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/profile/{profile_name}:
    get:
      operationId: getAIProfile
      summary: Palo Alto Networks Get AI Security Profile Details
      description: Returns the full configuration details for a named AI security profile including all detection categories, their enabled state, sensitivity thresholds, and configured enforcement actions. Use this endpoint to inspect the exact policy that will be applied when a scan references this profile name.
      tags:
      - Profiles
      parameters:
      - name: profile_name
        in: path
        required: true
        description: Name of the AI security profile to retrieve.
        schema:
          type: string
        example: Staging Firewall 95
      responses:
        '200':
          description: AI security profile details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AIProfile'
              examples:
                GetAiprofile200Example:
                  summary: Default getAIProfile 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '701673'
                    profile_name: Corporate Agent 92
                    description: Rule on network suspicious configured activity firewall monitoring Security rule.
                    detection_categories:
                    - category: pii_exposure
                      enabled: true
                      sensitivity: high
                      action: log
                    - category: toxic_content
                      enabled: false
                      sensitivity: low
                      action: alert
                    created_at: '2024-07-23T00:36:00Z'
                    updated_at: '2025-08-22T07:28:11Z'
        '401':
          description: Invalid or missing x-pan-token API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAiprofile401Example:
                  summary: Default getAIProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAiprofile403Example:
                  summary: Default getAIProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
        '404':
          description: Profile with the specified name not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAiprofile404Example:
                  summary: Default getAIProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAiprofile500Example:
                  summary: Default getAIProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Activity firewall applied traffic incident endpoint.
                    request_id: eb74a8d9-395b-4b9e-a68b-b66eb903b650
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Activity firewall applied traffic incident endpoint.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: eb74a8d9-395b-4b9e-a68b-b66eb903b650
    AIProfile:
      type: object
      properties:
        profile_id:
          type: string
          description: Unique identifier of the profile.
          example: '701673'
        profile_name:
          type: string
          description: Profile name used to reference this profile in scan requests.
          example: Corporate Agent 92
        description:
          type: string
          description: Human-readable description of the profile purpose and use case.
          example: Rule on network suspicious configured activity firewall monitoring Security rule.
        detection_categories:
          type: array
          description: Detection categories configured in this profile.
          items:
            type: object
            properties:
              category:
                type: string
                enum:
                - prompt_injection
                - jailbreak
                - data_leakage
                - toxic_content
                - malicious_url
                - pii_exposure
                - model_abuse
                example: malicious_url
              enabled:
                type: boolean
                description: Whether this detection category is active.
                example: true
              sensitivity:
                type: string
                enum:
                - low
                - medium
                - high
                description: Detection sensitivity threshold.
                example: medium
              action:
                type: string
                enum:
                - alert
                - block
                - log
                description: Enforcement action when this category triggers.
                example: block
          example:
          - category: pii_exposure
            enabled: true
            sensitivity: high
            action: log
          - category: toxic_content
            enabled: false
            sensitivity: low
            action: alert
        created_at:
          type: string
          format: date-time
          description: Timestamp when the profile was created.
          example: '2024-07-23T00:36:00Z'
        updated_at:
          type: string
          format: date-time
          description: Timestamp of the most recent profile modification.
          example: '2025-08-22T07:28:11Z'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.