openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Registry API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Registry
  description: Registry image scanning configuration and results.
paths:
  /registry:
    get:
      operationId: getRegistries
      summary: Palo Alto Networks List Configured Registries
      description: Returns a list of container registries configured for scanning in Prisma Cloud Compute. Each entry includes the registry URL, credential references, scanning scope, and schedule.
      tags:
      - Registry
      responses:
        '200':
          description: Registry configurations returned successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/RegistryConfig'
              examples:
                GetRegistries200Example:
                  summary: Default getRegistries 200 response
                  x-microcks-default: true
                  value:
                  - version: jfrog
                    registry: example-registry
                    namespace: Corporate Gateway 63
                    credentialID: '865122'
                    os: linux
                    cap: 304
                    scanners: 112
                    tag: critical-asset
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: addRegistry
      summary: Palo Alto Networks Add a Registry
      description: Adds a new container registry to the scanning configuration. Supports Docker Hub, AWS ECR, Azure Container Registry, Google Container Registry, and other OCI-compatible registries.
      tags:
      - Registry
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegistryConfig'
            examples:
              AddRegistryRequestExample:
                summary: Default addRegistry request
                x-microcks-default: true
                value:
                  version: jfrog
                  registry: example-registry
                  namespace: Corporate Gateway 63
                  credentialID: '865122'
                  os: linux
                  cap: 304
                  scanners: 112
                  tag: critical-asset
      responses:
        '200':
          description: Registry added successfully.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    RegistryConfig:
      type: object
      required:
      - version
      - registry
      properties:
        version:
          type: string
          description: Registry type identifier.
          enum:
          - dockerhub
          - aws
          - azure
          - gcr
          - jfrog
          - quay
          - other
          example: jfrog
        registry:
          type: string
          description: Registry URL or hostname.
          example: example-registry
        namespace:
          type: string
          description: Registry namespace or organization name.
          example: Corporate Gateway 63
        credentialID:
          type: string
          description: Credential store identifier for registry authentication.
          example: '865122'
        os:
          type: string
          enum:
          - linux
          - windows
          default: linux
          description: Base OS for scanned images.
          example: linux
        cap:
          type: integer
          description: Maximum number of images to scan from this registry.
          example: 304
        scanners:
          type: integer
          description: Number of scanner instances to use.
          example: 112
        tag:
          type: string
          description: Specific tag to scan. Scans all tags if omitted.
          example: critical-asset
    ErrorResponse:
      type: object
      properties:
        err:
          type: string
          description: Error message.
          example: example-err
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired authentication credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.