openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend RemoteNetworks API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: RemoteNetworks
  description: Remote network configuration for connecting branch offices and data centers to Prisma Access via IPSec tunnels.
paths:
  /remote-networks:
    get:
      operationId: listRemoteNetworks
      summary: Palo Alto Networks List Remote Networks
      description: Returns a list of all configured remote networks in the Prisma Access tenant. Each remote network represents a branch or data center site connected via IPSec tunnel. Supports filtering by name and folder, with pagination.
      tags:
      - RemoteNetworks
      parameters:
      - name: folder
        in: query
        description: Filter remote networks by folder (e.g., Remote Networks).
        schema:
          type: string
        example: example-folder
      - name: name
        in: query
        description: Filter by remote network name.
        schema:
          type: string
        example: Production Firewall 82
      - name: offset
        in: query
        description: Starting offset for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of results to return.
        schema:
          type: integer
          default: 200
          maximum: 5000
        example: 200
      responses:
        '200':
          description: Remote networks returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RemoteNetwork'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListRemoteNetworks200Example:
                  summary: Default listRemoteNetworks 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Corporate Sensor 34
                      region: us-west-2
                      license_type: FWAAS-AGGREGATE
                      spn_name: Production Gateway 60
                      ecmp_load_balancing: disable
                      subnets: &id001
                      - 10.231.109.0/24
                      - 10.117.88.0/24
                      folder: example-folder
                    - id: example-id
                      name: Corporate Sensor 34
                      region: us-west-2
                      license_type: FWAAS-AGGREGATE
                      spn_name: Production Gateway 60
                      ecmp_load_balancing: disable
                      subnets: *id001
                      folder: example-folder
                    offset: 310
                    total: 460
                    limit: 429
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createRemoteNetwork
      summary: Palo Alto Networks Create a Remote Network
      description: Creates a new remote network configuration in the candidate configuration. The remote network defines an IPSec tunnel endpoint for connecting a branch office or data center to Prisma Access. Changes must be pushed to take effect.
      tags:
      - RemoteNetworks
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the remote network (e.g., Remote Networks).
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetwork'
            examples:
              CreateRemoteNetworkRequestExample:
                summary: Default createRemoteNetwork request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Corporate Sensor 34
                  region: us-west-2
                  license_type: FWAAS-AGGREGATE
                  spn_name: Production Gateway 60
                  ecmp_load_balancing: disable
                  subnets: &id002
                  - 10.231.109.0/24
                  - 10.117.88.0/24
                  folder: example-folder
      responses:
        '201':
          description: Remote network created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                CreateRemoteNetwork201Example:
                  summary: Default createRemoteNetwork 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Sensor 34
                    region: us-west-2
                    license_type: FWAAS-AGGREGATE
                    spn_name: Production Gateway 60
                    ecmp_load_balancing: disable
                    subnets: *id002
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /remote-networks/{id}:
    get:
      operationId: getRemoteNetwork
      summary: Palo Alto Networks Get a Remote Network
      description: Returns the configuration of a specific remote network by ID.
      tags:
      - RemoteNetworks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique remote network identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Remote network returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                GetRemoteNetwork200Example:
                  summary: Default getRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Sensor 34
                    region: us-west-2
                    license_type: FWAAS-AGGREGATE
                    spn_name: Production Gateway 60
                    ecmp_load_balancing: disable
                    subnets:
                    - 10.231.109.0/24
                    - 10.117.88.0/24
                    folder: example-folder
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateRemoteNetwork
      summary: Palo Alto Networks Update a Remote Network
      description: Updates the configuration of an existing remote network in the candidate configuration. Changes must be pushed to take effect.
      tags:
      - RemoteNetworks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique remote network identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetwork'
            examples:
              UpdateRemoteNetworkRequestExample:
                summary: Default updateRemoteNetwork request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Corporate Sensor 34
                  region: us-west-2
                  license_type: FWAAS-AGGREGATE
                  spn_name: Production Gateway 60
                  ecmp_load_balancing: disable
                  subnets: &id003
                  - 10.231.109.0/24
                  - 10.117.88.0/24
                  folder: example-folder
      responses:
        '200':
          description: Remote network updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                UpdateRemoteNetwork200Example:
                  summary: Default updateRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Sensor 34
                    region: us-west-2
                    license_type: FWAAS-AGGREGATE
                    spn_name: Production Gateway 60
                    ecmp_load_balancing: disable
                    subnets: *id003
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteRemoteNetwork
      summary: Palo Alto Networks Delete a Remote Network
      description: Deletes a remote network from the candidate configuration. Changes must be pushed to take effect.
      tags:
      - RemoteNetworks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique remote network identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Remote network deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    RemoteNetwork:
      type: object
      required:
      - name
      - region
      properties:
        id:
          type: string
          description: Unique identifier for the remote network.
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name of the remote network.
          example: Corporate Sensor 34
        region:
          type: string
          description: Prisma Access compute region (e.g., us-east-1, eu-west-1).
          example: us-west-2
        license_type:
          type: string
          enum:
          - FWAAS-AGGREGATE
          - FWAAS-BYOL
          description: License type assigned to this remote network.
          example: FWAAS-AGGREGATE
        spn_name:
          type: string
          description: Service provider node name for the Prisma Access gateway location.
          example: Production Gateway 60
        ecmp_load_balancing:
          type: string
          enum:
          - enable
          - disable
          description: Enable or disable ECMP load balancing.
          example: disable
        subnets:
          type: array
          items:
            type: string
          description: Local subnets at the remote network site.
          example:
          - 10.231.109.0/24
          - 10.117.88.0/24
        folder:
          type: string
          description: Folder containing this remote network.
          readOnly: true
          example: example-folder
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Alert malware configured threat rule network malware configured on.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Threat configured alert firewall violation monitoring traffic activity.
            details: {}
          - code: example-code
            message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network.
            details: {}
        _request_id:
          type: string
          example: '980164'
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.