openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Recipients API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Recipients
  description: Email recipient retrieval operations.
paths:
  /email-incidents/{id}/recipients:
    get:
      operationId: getEmailIncidentRecipients
      summary: Palo Alto Networks Get Email Incident Recipients
      description: Returns the list of recipients for the email message associated with a specific DLP incident. Includes To, CC, and BCC recipients along with their delivery status.
      tags:
      - Recipients
      parameters:
      - name: id
        in: path
        required: true
        description: Unique incident identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Email recipients returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  incident_id:
                    type: string
                    description: Identifier of the parent incident.
                  recipients:
                    type: array
                    items:
                      $ref: '#/components/schemas/EmailRecipient'
              examples:
                GetEmailIncidentRecipients200Example:
                  summary: Default getEmailIncidentRecipients 200 response
                  x-microcks-default: true
                  value:
                    incident_id: '965151'
                    recipients:
                    - email: security-ops@example.com
                      type: cc
                      delivery_status: pending
                    - email: security-ops@example.com
                      type: cc
                      delivery_status: pending
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient role permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired bearer token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    EmailRecipient:
      type: object
      properties:
        email:
          type: string
          description: Recipient email address.
          example: security-ops@example.com
        type:
          type: string
          enum:
          - to
          - cc
          - bcc
          description: Recipient type indicating address field.
          example: cc
        delivery_status:
          type: string
          enum:
          - delivered
          - blocked
          - quarantined
          - pending
          description: Delivery status of the message to this recipient.
          example: pending
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code or type.
          example: example-error
        message:
          type: string
          description: Human-readable error message.
          example: Policy network malware on detected configured on incident blocked violation.
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.