openapi: 3.1.0 info: title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Services API description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform. version: '1.0' contact: name: Palo Alto Networks Developer Support url: https://pan.dev/ license: name: Proprietary url: https://www.paloaltonetworks.com/legal servers: - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1 description: AIOps for NGFW BPA API production server. security: - oauth2Bearer: [] tags: - name: Services paths: /services/get_services: post: operationId: getServices summary: Palo Alto Networks Get Exposed Services description: Returns a list of internet-exposed network services discovered by Xpanse. Services represent open ports and protocols observed on internet-facing assets. Supports filtering by service type, port, protocol, country, and associated asset. tags: - Services requestBody: required: true content: application/json: schema: type: object properties: request_data: type: object properties: filters: type: array items: $ref: '#/components/schemas/Filter' search_from: type: integer default: 0 search_to: type: integer default: 100 sort: $ref: '#/components/schemas/SortOrder' examples: GetServicesRequestExample: summary: Default getServices request x-microcks-default: true value: request_data: filters: - field: example-field operator: contains value: example-value - field: example-field operator: contains value: example-value search_from: 0 search_to: 100 sort: field: example-field keyword: asc responses: '200': description: Exposed services returned successfully. content: application/json: schema: type: object properties: reply: type: object properties: total_count: type: integer result_count: type: integer services: type: array items: $ref: '#/components/schemas/ExposedService' examples: GetServices200Example: summary: Default getServices 200 response x-microcks-default: true value: reply: total_count: 543 result_count: 703 services: - service_id: '336506' service_name: Corporate Agent 50 service_type: NETWORKING ip_address: &id001 - 10.239.5.194 domain: &id002 - example-domain_item - example-domain_item port: 278 protocol: TCP provider: &id003 - example-provider_item business_units: &id004 - example-business_units_item - example-business_units_item created: 966 last_observed: 356 is_active: Unconfirmed discovery_type: DirectlyDiscovered - service_id: '336506' service_name: Corporate Agent 50 service_type: NETWORKING ip_address: *id001 domain: *id002 port: 278 protocol: TCP provider: *id003 business_units: *id004 created: 966 last_observed: 356 is_active: Unconfirmed discovery_type: DirectlyDiscovered '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: Filter: type: object description: A filter criterion for querying Xpanse resources. required: - field - operator - value properties: field: type: string description: Field name to filter on. example: example-field operator: type: string enum: - in - contains - gte - lte - eq - neq example: contains value: description: Filter value (string, integer, or array for "in" operator). oneOf: - type: string - type: integer - type: array items: oneOf: - type: string - type: integer example: example-value ExposedService: type: object description: An internet-exposed network service discovered on an asset. properties: service_id: type: string example: '336506' service_name: type: string description: Service name or protocol (e.g., HTTPS, SSH, RDP). example: Corporate Agent 50 service_type: type: string enum: - APPLICATION_SERVER - CLOUD_STORAGE - DATABASE - NETWORKING - REMOTE_DESKTOP - UNCLASSIFIED - WEB example: NETWORKING ip_address: type: array items: type: string example: - 10.239.5.194 domain: type: array items: type: string example: - example-domain_item - example-domain_item port: type: integer description: TCP/UDP port number. example: 278 protocol: type: string enum: - TCP - UDP example: TCP provider: type: array items: type: string description: Cloud or hosting providers detected for this service. example: - example-provider_item business_units: type: array items: type: string example: - example-business_units_item - example-business_units_item created: type: integer description: Service first discovery timestamp as Unix epoch milliseconds. example: 966 last_observed: type: integer example: 356 is_active: type: string enum: - Active - Inactive - Unconfirmed example: Unconfirmed discovery_type: type: string enum: - ColocatedOnIp - DirectlyDiscovered - CSP - CertificateAssociation example: DirectlyDiscovered ErrorResponse: type: object properties: reply: type: object properties: err_code: type: integer example: 849 err_msg: type: string example: example-err_msg err_extra: type: string example: example-err_extra example: err_code: 931 err_msg: example-err_msg err_extra: example-err_extra SortOrder: type: object description: Sorting specification for result sets. properties: field: type: string example: example-field keyword: type: string enum: - asc - desc example: asc responses: Unauthorized: description: Missing or invalid authentication headers. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' BadRequest: description: Malformed request body or invalid parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: oauth2Bearer: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.