openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Syslog Destinations API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Syslog Destinations
  description: Syslog forwarding destination management.
paths:
  /log-forwarding-profiles/{profile_id}/destinations/syslog:
    get:
      operationId: listSyslogDestinations
      summary: Palo Alto Networks List Syslog Destinations
      description: Returns the syslog destinations configured for a log forwarding profile.
      tags:
      - Syslog Destinations
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '415149'
      responses:
        '200':
          description: Syslog destinations returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SyslogDestination'
              examples:
                ListSyslogDestinations200Example:
                  summary: Default listSyslogDestinations 200 response
                  x-microcks-default: true
                  value:
                    total: 773
                    items:
                    - destination_id: '414925'
                      name: Staging Firewall 26
                      server: example-server
                      port: 226
                      protocol: TCP
                      format: IETF
                      facility: example-facility
                      enabled: false
                      created_at: '2025-03-07T13:34:55Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSyslogDestinations401Example:
                  summary: Default listSyslogDestinations 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSyslogDestinations403Example:
                  summary: Default listSyslogDestinations 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSyslogDestinations404Example:
                  summary: Default listSyslogDestinations 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListSyslogDestinations500Example:
                  summary: Default listSyslogDestinations 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSyslogDestination
      summary: Palo Alto Networks Create Syslog Destination
      description: Adds a syslog destination to a log forwarding profile.
      tags:
      - Syslog Destinations
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '907964'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SyslogDestinationRequest'
            examples:
              CreateSyslogDestinationRequestExample:
                summary: Default createSyslogDestination request
                x-microcks-default: true
                value:
                  name: Branch Sensor 93
                  server: example-server
                  port: 20582
                  protocol: SSL
                  format: IETF
                  facility: LOG_USER
                  enabled: true
      responses:
        '201':
          description: Syslog destination created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SyslogDestination'
              examples:
                CreateSyslogDestination201Example:
                  summary: Default createSyslogDestination 201 response
                  x-microcks-default: true
                  value:
                    destination_id: '414925'
                    name: Staging Firewall 26
                    server: example-server
                    port: 226
                    protocol: TCP
                    format: IETF
                    facility: example-facility
                    enabled: false
                    created_at: '2025-03-07T13:34:55Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSyslogDestination400Example:
                  summary: Default createSyslogDestination 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSyslogDestination401Example:
                  summary: Default createSyslogDestination 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSyslogDestination403Example:
                  summary: Default createSyslogDestination 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSyslogDestination404Example:
                  summary: Default createSyslogDestination 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateSyslogDestination500Example:
                  summary: Default createSyslogDestination 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SyslogDestination:
      type: object
      properties:
        destination_id:
          type: string
          description: Unique identifier of the syslog destination.
          example: '414925'
        name:
          type: string
          description: Display name of the destination.
          example: Staging Firewall 26
        server:
          type: string
          description: Syslog server hostname or IP address.
          example: example-server
        port:
          type: integer
          description: Syslog server port.
          example: 226
        protocol:
          type: string
          enum:
          - UDP
          - TCP
          - SSL
          description: Transport protocol for syslog delivery.
          example: TCP
        format:
          type: string
          enum:
          - IETF
          - BSD
          - CSV
          description: Syslog message format.
          example: IETF
        facility:
          type: string
          description: Syslog facility value.
          example: example-facility
        enabled:
          type: boolean
          example: false
        created_at:
          type: string
          format: date-time
          example: '2025-03-07T13:34:55Z'
    SyslogDestinationRequest:
      type: object
      required:
      - name
      - server
      - port
      - protocol
      properties:
        name:
          type: string
          description: Display name for this syslog destination.
          example: Branch Sensor 93
        server:
          type: string
          description: Syslog server hostname or IP address.
          example: example-server
        port:
          type: integer
          minimum: 1
          maximum: 65535
          description: Syslog server port number.
          example: 20582
        protocol:
          type: string
          enum:
          - UDP
          - TCP
          - SSL
          description: Transport protocol.
          example: SSL
        format:
          type: string
          enum:
          - IETF
          - BSD
          - CSV
          default: IETF
          example: IETF
        facility:
          type: string
          default: LOG_USER
          example: LOG_USER
        enabled:
          type: boolean
          default: true
          example: true
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 59fcc104-7100-494b-b0c4-09f9dcc477d9
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.