openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Targets API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Targets
  description: AI scan target definition and management.
paths:
  /v1/targets:
    post:
      operationId: createScanTarget
      summary: Palo Alto Networks Create Scan Target
      description: Creates a new scan target representing an AI application or LLM endpoint to be assessed. Targets define the endpoint URL, the type of AI interface (chat completions, custom API, etc.), and the authentication configuration needed to interact with the endpoint during the red teaming scan.
      tags:
      - Targets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScanTargetRequest'
            examples:
              CreateScanTargetRequestExample:
                summary: Default createScanTarget request
                x-microcks-default: true
                value:
                  name: Primary Agent 91
                  description: On violation blocked incident traffic monitoring.
                  type: huggingface
                  endpoint_url: https://api.acme-systems.org/696e96
                  model: PA-3260
                  auth_config:
                    type: basic
                    header_name: Corporate Sensor 86
                    credential: example-credential
                  system_prompt: example-system_prompt
      responses:
        '201':
          description: Scan target created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanTarget'
              examples:
                CreateScanTarget201Example:
                  summary: Default createScanTarget 201 response
                  x-microcks-default: true
                  value:
                    target_id: '296460'
                    name: Branch Policy 32
                    description: Detected violation Security incident threat violation malware firewall policy incident rule rule.
                    type: openai_chat
                    endpoint_url: https://vpn.example.com/8fea53
                    model: PA-5250
                    created_at: '2025-11-15T21:07:35Z'
                    updated_at: '2024-07-13T20:05:13Z'
        '400':
          description: Invalid request body or endpoint unreachable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateScanTarget400Example:
                  summary: Default createScanTarget 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateScanTarget401Example:
                  summary: Default createScanTarget 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateScanTarget403Example:
                  summary: Default createScanTarget 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '409':
          description: A target with this name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateScanTarget409Example:
                  summary: Default createScanTarget 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateScanTarget500Example:
                  summary: Default createScanTarget 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    get:
      operationId: listScanTargets
      summary: Palo Alto Networks List Scan Targets
      description: Returns the list of scan targets configured for the tenant. Each target represents an AI application endpoint that can be selected when starting a vulnerability scan.
      tags:
      - Targets
      parameters:
      - name: type
        in: query
        description: Filter targets by interface type.
        schema:
          type: string
          enum:
          - openai_chat
          - anthropic_messages
          - custom_http
          - huggingface
        example: huggingface
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of targets to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Scan targets returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/ScanTarget'
              examples:
                ListScanTargets200Example:
                  summary: Default listScanTargets 200 response
                  x-microcks-default: true
                  value:
                    total: 516
                    offset: 395
                    limit: 914
                    items:
                    - target_id: '296460'
                      name: Branch Policy 32
                      description: Detected violation Security incident threat violation malware firewall policy incident rule rule.
                      type: openai_chat
                      endpoint_url: https://vpn.example.com/8fea53
                      model: PA-5250
                      created_at: '2025-11-15T21:07:35Z'
                      updated_at: '2024-07-13T20:05:13Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListScanTargets400Example:
                  summary: Default listScanTargets 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListScanTargets401Example:
                  summary: Default listScanTargets 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListScanTargets403Example:
                  summary: Default listScanTargets 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListScanTargets500Example:
                  summary: Default listScanTargets 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/targets/{target_id}:
    get:
      operationId: getScanTarget
      summary: Palo Alto Networks Get Scan Target Details
      description: Returns full details for a specific scan target by ID.
      tags:
      - Targets
      parameters:
      - name: target_id
        in: path
        required: true
        description: Unique identifier of the scan target.
        schema:
          type: string
        example: '583704'
      responses:
        '200':
          description: Scan target details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanTarget'
              examples:
                GetScanTarget200Example:
                  summary: Default getScanTarget 200 response
                  x-microcks-default: true
                  value:
                    target_id: '296460'
                    name: Branch Policy 32
                    description: Detected violation Security incident threat violation malware firewall policy incident rule rule.
                    type: openai_chat
                    endpoint_url: https://vpn.example.com/8fea53
                    model: PA-5250
                    created_at: '2025-11-15T21:07:35Z'
                    updated_at: '2024-07-13T20:05:13Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetScanTarget401Example:
                  summary: Default getScanTarget 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetScanTarget403Example:
                  summary: Default getScanTarget 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '404':
          description: Scan target not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetScanTarget404Example:
                  summary: Default getScanTarget 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetScanTarget500Example:
                  summary: Default getScanTarget 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteScanTarget
      summary: Palo Alto Networks Delete Scan Target
      description: Deletes a scan target. Targets with active or pending scans cannot be deleted until scans complete.
      tags:
      - Targets
      parameters:
      - name: target_id
        in: path
        required: true
        description: Unique identifier of the scan target to delete.
        schema:
          type: string
        example: '101292'
      responses:
        '204':
          description: Scan target deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteScanTarget401Example:
                  summary: Default deleteScanTarget 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteScanTarget403Example:
                  summary: Default deleteScanTarget 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '404':
          description: Scan target not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteScanTarget404Example:
                  summary: Default deleteScanTarget 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '409':
          description: Target has active scans and cannot be deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteScanTarget409Example:
                  summary: Default deleteScanTarget 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteScanTarget500Example:
                  summary: Default deleteScanTarget 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Policy investigation blocked activity on activity suspicious configured configured suspicious.
                    request_id: f62400eb-5426-47bb-acc1-166eb163d06c
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Policy investigation blocked activity on activity suspicious configured configured suspicious.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: f62400eb-5426-47bb-acc1-166eb163d06c
    ScanTarget:
      type: object
      properties:
        target_id:
          type: string
          description: Unique identifier of the scan target.
          example: '296460'
        name:
          type: string
          description: Display name of the scan target.
          example: Branch Policy 32
        description:
          type: string
          description: Description of the target AI application.
          example: Detected violation Security incident threat violation malware firewall policy incident rule rule.
        type:
          type: string
          enum:
          - openai_chat
          - anthropic_messages
          - custom_http
          - huggingface
          description: AI interface type of the target endpoint.
          example: openai_chat
        endpoint_url:
          type: string
          format: uri
          description: URL of the AI application endpoint.
          example: https://vpn.example.com/8fea53
        model:
          type: string
          description: AI model name or identifier used by the endpoint.
          example: PA-5250
        created_at:
          type: string
          format: date-time
          example: '2025-11-15T21:07:35Z'
        updated_at:
          type: string
          format: date-time
          example: '2024-07-13T20:05:13Z'
    ScanTargetRequest:
      type: object
      required:
      - name
      - type
      - endpoint_url
      properties:
        name:
          type: string
          description: Display name for the scan target.
          maxLength: 256
          example: Primary Agent 91
        description:
          type: string
          description: Optional description of the target application.
          example: On violation blocked incident traffic monitoring.
        type:
          type: string
          enum:
          - openai_chat
          - anthropic_messages
          - custom_http
          - huggingface
          description: AI interface type of the target endpoint.
          example: huggingface
        endpoint_url:
          type: string
          format: uri
          description: URL of the AI application endpoint to scan.
          example: https://api.acme-systems.org/696e96
        model:
          type: string
          description: AI model name to include in requests (e.g., gpt-4o, claude-3-5-sonnet-20241022).
          example: PA-3260
        auth_config:
          type: object
          description: Authentication configuration for the target endpoint.
          properties:
            type:
              type: string
              enum:
              - bearer_token
              - api_key_header
              - basic
              - none
              description: Authentication method.
              example: basic
            header_name:
              type: string
              description: Header name for API key authentication.
              example: Corporate Gateway 37
            credential:
              type: string
              description: Authentication credential value (API key or token).
              writeOnly: true
              example: example-credential
          example:
            type: basic
            header_name: Corporate Sensor 86
            credential: example-credential
        system_prompt:
          type: string
          description: System prompt to include in requests to the target. Used to scope red teaming attacks to the intended application context.
          maxLength: 8192
          example: example-system_prompt
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.