openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Roles API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Roles
  description: Available IAM roles and their permissions.
paths:
  /roles:
    get:
      operationId: listRoles
      summary: Palo Alto Networks List Available Roles
      description: Returns the list of available IAM roles that can be assigned in access policies. Each role defines a set of API permissions for specific SASE services and operations.
      tags:
      - Roles
      responses:
        '200':
          description: Available roles returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Role'
              examples:
                ListRoles200Example:
                  summary: Default listRoles 200 response
                  x-microcks-default: true
                  value:
                    total: 293
                    items:
                    - id: example-id
                      name: Branch Policy 17
                      display_name: Carlos Garcia
                      description: Alert network suspicious applied blocked detected.
                      permissions:
                      - example-permissions_item
                      - example-permissions_item
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRoles401Example:
                  summary: Default listRoles 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRoles403Example:
                  summary: Default listRoles 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRoles500Example:
                  summary: Default listRoles 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Role:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the role.
          example: example-id
        name:
          type: string
          description: Role name (e.g., superuser, network_admin, readonly).
          example: Branch Policy 17
        display_name:
          type: string
          description: Human-readable role display name.
          example: Carlos Garcia
        description:
          type: string
          description: Description of the permissions granted by this role.
          example: Alert network suspicious applied blocked detected.
        permissions:
          type: array
          items:
            type: string
          description: List of permission identifiers included in this role.
          example:
          - example-permissions_item
          - example-permissions_item
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Malware endpoint traffic incident on on traffic rule endpoint traffic.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 1e1e39dd-16dd-4699-a272-365b75e92268
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.