openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend ServiceConnections API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: ServiceConnections
  description: Service connection management for providing access to internal resources through Prisma Access.
paths:
  /service-connections:
    get:
      operationId: listServiceConnections
      summary: Palo Alto Networks List Service Connections
      description: Returns a list of all configured service connections. Service connections provide access to internal data center resources from Prisma Access through dedicated IPSec tunnels.
      tags:
      - ServiceConnections
      parameters:
      - name: folder
        in: query
        description: Filter by folder.
        schema:
          type: string
        example: example-folder
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 200
        example: 200
      responses:
        '200':
          description: Service connections returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ServiceConnection'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListServiceConnections200Example:
                  summary: Default listServiceConnections 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Branch Sensor 44
                      region: us-west-2
                      ipsec_tunnel: example-ipsec_tunnel
                      subnets: &id001
                      - 10.241.132.0/24
                      - 10.82.85.0/24
                      nat_pool: example-nat_pool
                      qos_enabled: false
                      folder: example-folder
                    - id: example-id
                      name: Branch Sensor 44
                      region: us-west-2
                      ipsec_tunnel: example-ipsec_tunnel
                      subnets: *id001
                      nat_pool: example-nat_pool
                      qos_enabled: false
                      folder: example-folder
                    offset: 852
                    total: 192
                    limit: 331
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createServiceConnection
      summary: Palo Alto Networks Create a Service Connection
      description: Creates a new service connection in the candidate configuration. Changes must be pushed to take effect.
      tags:
      - ServiceConnections
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the service connection.
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceConnection'
            examples:
              CreateServiceConnectionRequestExample:
                summary: Default createServiceConnection request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 44
                  region: us-west-2
                  ipsec_tunnel: example-ipsec_tunnel
                  subnets: &id002
                  - 10.241.132.0/24
                  - 10.82.85.0/24
                  nat_pool: example-nat_pool
                  qos_enabled: false
                  folder: example-folder
      responses:
        '201':
          description: Service connection created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceConnection'
              examples:
                CreateServiceConnection201Example:
                  summary: Default createServiceConnection 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 44
                    region: us-west-2
                    ipsec_tunnel: example-ipsec_tunnel
                    subnets: *id002
                    nat_pool: example-nat_pool
                    qos_enabled: false
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /service-connections/{id}:
    get:
      operationId: getServiceConnection
      summary: Palo Alto Networks Get a Service Connection
      description: Returns the configuration of a specific service connection.
      tags:
      - ServiceConnections
      parameters:
      - name: id
        in: path
        required: true
        description: Unique service connection identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Service connection returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceConnection'
              examples:
                GetServiceConnection200Example:
                  summary: Default getServiceConnection 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 44
                    region: us-west-2
                    ipsec_tunnel: example-ipsec_tunnel
                    subnets:
                    - 10.241.132.0/24
                    - 10.82.85.0/24
                    nat_pool: example-nat_pool
                    qos_enabled: false
                    folder: example-folder
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateServiceConnection
      summary: Palo Alto Networks Update a Service Connection
      description: Updates an existing service connection in the candidate configuration.
      tags:
      - ServiceConnections
      parameters:
      - name: id
        in: path
        required: true
        description: Unique service connection identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceConnection'
            examples:
              UpdateServiceConnectionRequestExample:
                summary: Default updateServiceConnection request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 44
                  region: us-west-2
                  ipsec_tunnel: example-ipsec_tunnel
                  subnets: &id003
                  - 10.241.132.0/24
                  - 10.82.85.0/24
                  nat_pool: example-nat_pool
                  qos_enabled: false
                  folder: example-folder
      responses:
        '200':
          description: Service connection updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceConnection'
              examples:
                UpdateServiceConnection200Example:
                  summary: Default updateServiceConnection 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 44
                    region: us-west-2
                    ipsec_tunnel: example-ipsec_tunnel
                    subnets: *id003
                    nat_pool: example-nat_pool
                    qos_enabled: false
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteServiceConnection
      summary: Palo Alto Networks Delete a Service Connection
      description: Deletes a service connection from the candidate configuration.
      tags:
      - ServiceConnections
      parameters:
      - name: id
        in: path
        required: true
        description: Unique service connection identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Service connection deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ServiceConnection:
      type: object
      required:
      - name
      - region
      - ipsec_tunnel
      properties:
        id:
          type: string
          description: Unique identifier for the service connection.
          readOnly: true
          example: example-id
        name:
          type: string
          description: Name of the service connection.
          example: Branch Sensor 44
        region:
          type: string
          description: Prisma Access compute region.
          example: us-west-2
        ipsec_tunnel:
          type: string
          description: Name of the associated IPSec tunnel.
          example: example-ipsec_tunnel
        subnets:
          type: array
          items:
            type: string
          description: Internal subnets accessible through this connection.
          example:
          - 10.241.132.0/24
          - 10.82.85.0/24
        nat_pool:
          type: string
          description: NAT pool CIDR for source translation.
          example: example-nat_pool
        qos_enabled:
          type: boolean
          default: false
          description: Whether QoS is enabled on this connection.
          example: false
        folder:
          type: string
          readOnly: true
          example: example-folder
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Alert malware configured threat rule network malware configured on.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Threat configured alert firewall violation monitoring traffic activity.
            details: {}
          - code: example-code
            message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network.
            details: {}
        _request_id:
          type: string
          example: '980164'
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.