openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Settings API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Settings
  description: Log forwarding and configuration settings.
paths:
  /api/settings/log-forwarding:
    get:
      operationId: getLogForwardingSettings
      summary: Palo Alto Networks Get Log Forwarding Settings
      description: Returns the current log forwarding configuration for the SaaS Security tenant, including enabled destinations such as syslog servers, SIEM integrations, and storage buckets.
      tags:
      - Settings
      responses:
        '200':
          description: Log forwarding settings returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingSettings'
              examples:
                GetLogForwardingSettings200Example:
                  summary: Default getLogForwardingSettings 200 response
                  x-microcks-default: true
                  value:
                    enabled: false
                    destinations:
                    - type: s3
                      name: Staging Firewall 89
                      enabled: true
                      log_types:
                      - custom
                      - standard
                    - type: splunk
                      name: Staging Sensor 80
                      enabled: true
                      log_types:
                      - standard
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingSettings401Example:
                  summary: Default getLogForwardingSettings 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingSettings403Example:
                  summary: Default getLogForwardingSettings 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingSettings500Example:
                  summary: Default getLogForwardingSettings 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Configured monitoring network blocked investigation applied activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 5cc3d66e-5479-4e15-bd64-849adde3cb60
    LogForwardingSettings:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether log forwarding is globally enabled.
          example: false
        destinations:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
                enum:
                - syslog
                - https
                - s3
                - splunk
                description: Forwarding destination type.
                example: s3
              name:
                type: string
                description: Destination name.
                example: Staging Policy 90
              enabled:
                type: boolean
                description: Whether this destination is active.
                example: true
              log_types:
                type: array
                items:
                  type: string
                description: Log types forwarded to this destination.
                example:
                - standard
          example:
          - type: s3
            name: Staging Firewall 89
            enabled: true
            log_types:
            - custom
            - standard
          - type: splunk
            name: Staging Sensor 80
            enabled: true
            log_types:
            - standard
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.