openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Search API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Search
  description: RQL-based resource and configuration search.
paths:
  /search/asset:
    post:
      operationId: searchAsset
      summary: Palo Alto Networks Search Assets with RQL
      description: Executes an RQL (Resource Query Language) asset query against cloud resource configurations and returns matching resources. Supports config, network, and event query types.
      tags:
      - Search
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - query
              - timeRange
              properties:
                query:
                  type: string
                  description: RQL query string (e.g., "config from cloud.resource where cloud.type = 'aws'").
                timeRange:
                  $ref: '#/components/schemas/TimeRange'
                limit:
                  type: integer
                  default: 100
                withResourceJson:
                  type: boolean
                  default: false
            examples:
              SearchAssetRequestExample:
                summary: Default searchAsset request
                x-microcks-default: true
                value:
                  query: example-query
                  timeRange:
                    type: to_now
                    value:
                      amount: 301
                      unit: year
                  limit: 100
                  withResourceJson: false
      responses:
        '200':
          description: Asset search results returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchResult'
              examples:
                SearchAsset200Example:
                  summary: Default searchAsset 200 response
                  x-microcks-default: true
                  value:
                    cloudType: advanced
                    query: example-query
                    data:
                      totalRows: 728
                      items:
                      - id: example-id
                        name: Branch Sensor 66
                        cloudType: standard
                        accountId: '697058'
                        accountName: Production Agent 91
                        regionId: '906120'
                        resourceType: advanced
                        overallPassed: false
                      - id: example-id
                        name: Branch Firewall 11
                        cloudType: advanced
                        accountId: '226442'
                        accountName: Corporate Agent 48
                        regionId: '307869'
                        resourceType: standard
                        overallPassed: false
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /search/config:
    post:
      operationId: searchConfig
      summary: Palo Alto Networks Search Cloud Resource Configurations
      description: Executes an RQL config query against cloud resource configurations. Returns resources matching the query criteria with their configuration details.
      tags:
      - Search
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - query
              - timeRange
              properties:
                query:
                  type: string
                  description: RQL config query string.
                timeRange:
                  $ref: '#/components/schemas/TimeRange'
                limit:
                  type: integer
                  default: 100
                withResourceJson:
                  type: boolean
                  default: false
            examples:
              SearchConfigRequestExample:
                summary: Default searchConfig request
                x-microcks-default: true
                value:
                  query: example-query
                  timeRange:
                    type: to_now
                    value:
                      amount: 301
                      unit: year
                  limit: 100
                  withResourceJson: false
      responses:
        '200':
          description: Config search results returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchResult'
              examples:
                SearchConfig200Example:
                  summary: Default searchConfig 200 response
                  x-microcks-default: true
                  value:
                    cloudType: advanced
                    query: example-query
                    data:
                      totalRows: 728
                      items:
                      - id: example-id
                        name: Branch Sensor 66
                        cloudType: standard
                        accountId: '697058'
                        accountName: Production Agent 91
                        regionId: '906120'
                        resourceType: advanced
                        overallPassed: false
                      - id: example-id
                        name: Branch Firewall 11
                        cloudType: advanced
                        accountId: '226442'
                        accountName: Corporate Agent 48
                        regionId: '307869'
                        resourceType: standard
                        overallPassed: false
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired JWT token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 747
        message:
          type: string
          description: Human-readable error message.
          example: Traffic violation investigation monitoring policy incident applied threat monitoring alert.
        error:
          type: string
          description: Error code.
          example: example-error
    SearchResult:
      type: object
      properties:
        cloudType:
          type: string
          description: Cloud provider type for the search results.
          example: advanced
        query:
          type: string
          description: RQL query that was executed.
          example: example-query
        data:
          type: object
          properties:
            totalRows:
              type: integer
              description: Total number of matching resources.
              example: 912
            items:
              type: array
              items:
                type: object
                properties:
                  id:
                    type: string
                    example: example-id
                  name:
                    type: string
                    example: Primary Policy 16
                  cloudType:
                    type: string
                    example: custom
                  accountId:
                    type: string
                    example: '747806'
                  accountName:
                    type: string
                    example: Staging Gateway 41
                  regionId:
                    type: string
                    example: '650238'
                  resourceType:
                    type: string
                    example: standard
                  overallPassed:
                    type: boolean
                    example: true
              example:
              - id: example-id
                name: Branch Firewall 48
                cloudType: custom
                accountId: '245566'
                accountName: Staging Policy 24
                regionId: '477008'
                resourceType: custom
                overallPassed: true
              - id: example-id
                name: Staging Firewall 71
                cloudType: custom
                accountId: '996140'
                accountName: Staging Gateway 36
                regionId: '333526'
                resourceType: custom
                overallPassed: true
          example:
            totalRows: 728
            items:
            - id: example-id
              name: Branch Sensor 66
              cloudType: standard
              accountId: '697058'
              accountName: Production Agent 91
              regionId: '906120'
              resourceType: advanced
              overallPassed: false
            - id: example-id
              name: Branch Firewall 11
              cloudType: advanced
              accountId: '226442'
              accountName: Corporate Agent 48
              regionId: '307869'
              resourceType: standard
              overallPassed: false
    TimeRange:
      type: object
      properties:
        type:
          type: string
          enum:
          - relative
          - absolute
          - to_now
          example: to_now
        value:
          type: object
          properties:
            amount:
              type: integer
              example: 810
            unit:
              type: string
              enum:
              - minute
              - hour
              - day
              - week
              - month
              - year
              example: week
          example:
            amount: 301
            unit: year
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.