openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Suppressions API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Suppressions
  description: Suppression rules for managing policy violations.
paths:
  /suppressions:
    get:
      operationId: listSuppressions
      summary: Palo Alto Networks List Suppressions
      description: Returns a list of suppression rules for policy violations. Suppressions can be scoped to a specific resource, file, repository, or applied globally for a policy.
      tags:
      - Suppressions
      parameters:
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 25
        example: 25
      - name: policyId
        in: query
        description: Filter suppressions by Checkov policy ID.
        schema:
          type: string
        example: '981710'
      - name: suppressionType
        in: query
        description: Filter by suppression scope.
        schema:
          type: string
          enum:
          - Policy
          - Resources
          - Accounts
          - Tags
        example: Policy
      responses:
        '200':
          description: Suppressions returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  totalCount:
                    type: integer
                    description: Total number of suppression rules.
                  suppressions:
                    type: array
                    items:
                      $ref: '#/components/schemas/Suppression'
              examples:
                ListSuppressions200Example:
                  summary: Default listSuppressions 200 response
                  x-microcks-default: true
                  value:
                    totalCount: 663
                    suppressions:
                    - suppressionId: '518567'
                      policyId: '162253'
                      policyName: Branch Policy 92
                      suppressionType: Resources
                      justification: example-justification
                      createdBy: example-createdBy
                      createdAt: '2026-05-28T01:52:46Z'
                      expirationDate: '2025-01-22T20:00:21Z'
                      suppressedErrorCount: 194
                    - suppressionId: '518567'
                      policyId: '162253'
                      policyName: Branch Policy 92
                      suppressionType: Resources
                      justification: example-justification
                      createdBy: example-createdBy
                      createdAt: '2026-05-28T01:52:46Z'
                      expirationDate: '2025-01-22T20:00:21Z'
                      suppressedErrorCount: 194
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSuppression
      summary: Palo Alto Networks Create a Suppression
      description: Creates a suppression rule to suppress specific code security policy violations. Use suppressions to manage accepted risks, false positives, or findings addressed through compensating controls.
      tags:
      - Suppressions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - policyId
              - suppressionType
              properties:
                policyId:
                  type: string
                  description: Checkov policy ID to suppress (e.g., CKV_AWS_18).
                suppressionType:
                  type: string
                  enum:
                  - Policy
                  - Resources
                  - Accounts
                  - Tags
                  description: Scope of the suppression rule.
                justification:
                  type: string
                  description: Reason for creating the suppression.
                expirationDate:
                  type: string
                  format: date-time
                  description: Optional expiration date for the suppression.
                resources:
                  type: array
                  items:
                    type: object
                    properties:
                      repositoryId:
                        type: string
                      filePath:
                        type: string
                      resourceId:
                        type: string
                  description: Specific resources to suppress. Required when suppressionType is Resources.
            examples:
              CreateSuppressionRequestExample:
                summary: Default createSuppression request
                x-microcks-default: true
                value:
                  policyId: '694864'
                  suppressionType: Resources
                  justification: example-justification
                  expirationDate: '2024-03-12T16:44:56Z'
                  resources:
                  - repositoryId: '321691'
                    filePath: /api/v1/c851d2
                    resourceId: '717744'
      responses:
        '200':
          description: Suppression created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Suppression'
              examples:
                CreateSuppression200Example:
                  summary: Default createSuppression 200 response
                  x-microcks-default: true
                  value:
                    suppressionId: '518567'
                    policyId: '162253'
                    policyName: Branch Policy 92
                    suppressionType: Resources
                    justification: example-justification
                    createdBy: example-createdBy
                    createdAt: '2026-05-28T01:52:46Z'
                    expirationDate: '2025-01-22T20:00:21Z'
                    suppressedErrorCount: 194
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /suppressions/{suppression_id}:
    delete:
      operationId: deleteSuppression
      summary: Palo Alto Networks Delete a Suppression
      description: Deletes a specific suppression rule. The suppressed policy violations will resume being reported.
      tags:
      - Suppressions
      parameters:
      - name: suppression_id
        in: path
        required: true
        description: Unique suppression identifier.
        schema:
          type: string
        example: '985961'
      responses:
        '200':
          description: Suppression deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 602
        message:
          type: string
          description: Human-readable error message.
          example: Traffic activity investigation malware violation policy Security monitoring.
        error:
          type: string
          description: Error code.
          example: example-error
    Suppression:
      type: object
      properties:
        suppressionId:
          type: string
          description: Unique suppression rule identifier.
          example: '518567'
        policyId:
          type: string
          description: Checkov policy ID being suppressed.
          example: '162253'
        policyName:
          type: string
          description: Human-readable policy name.
          example: Branch Policy 92
        suppressionType:
          type: string
          enum:
          - Policy
          - Resources
          - Accounts
          - Tags
          description: Scope of the suppression.
          example: Resources
        justification:
          type: string
          description: Reason provided for the suppression.
          example: example-justification
        createdBy:
          type: string
          description: Email address of the user who created the suppression.
          example: example-createdBy
        createdAt:
          type: string
          format: date-time
          description: Timestamp when the suppression was created.
          example: '2026-05-28T01:52:46Z'
        expirationDate:
          type: string
          format: date-time
          description: Expiration date. Null if the suppression does not expire.
          example: '2025-01-22T20:00:21Z'
        suppressedErrorCount:
          type: integer
          description: Number of errors currently suppressed by this rule.
          example: 194
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.