openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Subnet Rules API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Subnet Rules
  description: Subnet-based access rules for ZTNA network segments.
paths:
  /v2/subnet-rules:
    get:
      operationId: listSubnetRules
      summary: Palo Alto Networks List Subnet-based Access Rules
      description: Returns the list of subnet-based access rules that define which IP network ranges are accessible through ZTNA connectors.
      tags:
      - Subnet Rules
      responses:
        '200':
          description: Subnet rules returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SubnetRule'
              examples:
                ListSubnetRules200Example:
                  summary: Default listSubnetRules 200 response
                  x-microcks-default: true
                  value:
                    total: 295
                    items:
                    - rule_id: '373292'
                      name: Corporate Firewall 37
                      subnet: 10.131.182.0/24
                      group_id: '527569'
                      enabled: false
                      created_at: '2025-04-09T20:01:23Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSubnetRules401Example:
                  summary: Default listSubnetRules 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSubnetRules403Example:
                  summary: Default listSubnetRules 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSubnetRules500Example:
                  summary: Default listSubnetRules 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSubnetRule
      summary: Palo Alto Networks Create Subnet-based Access Rule
      description: Creates a new subnet-based access rule for ZTNA.
      tags:
      - Subnet Rules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubnetRuleRequest'
            examples:
              CreateSubnetRuleRequestExample:
                summary: Default createSubnetRule request
                x-microcks-default: true
                value:
                  name: Production Firewall 11
                  subnet: 10.175.38.0/24
                  group_id: '115097'
                  enabled: true
      responses:
        '201':
          description: Subnet rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubnetRule'
              examples:
                CreateSubnetRule201Example:
                  summary: Default createSubnetRule 201 response
                  x-microcks-default: true
                  value:
                    rule_id: '373292'
                    name: Corporate Firewall 37
                    subnet: 10.131.182.0/24
                    group_id: '527569'
                    enabled: false
                    created_at: '2025-04-09T20:01:23Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSubnetRule400Example:
                  summary: Default createSubnetRule 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSubnetRule401Example:
                  summary: Default createSubnetRule 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSubnetRule403Example:
                  summary: Default createSubnetRule 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSubnetRule500Example:
                  summary: Default createSubnetRule 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SubnetRule:
      type: object
      properties:
        rule_id:
          type: string
          description: Unique identifier of the subnet rule.
          example: '373292'
        name:
          type: string
          description: Display name of the rule.
          example: Corporate Firewall 37
        subnet:
          type: string
          description: CIDR notation subnet this rule covers (e.g., 10.0.0.0/8).
          example: 10.131.182.0/24
        group_id:
          type: string
          description: Connector group used to route traffic to this subnet.
          example: '527569'
        enabled:
          type: boolean
          description: Whether this rule is active.
          example: false
        created_at:
          type: string
          format: date-time
          example: '2025-04-09T20:01:23Z'
    SubnetRuleRequest:
      type: object
      required:
      - name
      - subnet
      - group_id
      properties:
        name:
          type: string
          description: Display name for the subnet rule.
          example: Production Firewall 11
        subnet:
          type: string
          description: CIDR notation subnet this rule covers.
          example: 10.175.38.0/24
        group_id:
          type: string
          description: Connector group to use for routing traffic to this subnet.
          example: '115097'
        enabled:
          type: boolean
          default: true
          example: true
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Security firewall network configured traffic blocked threat.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 709c60bb-8234-4bc4-938b-d0835224c350
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.