openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend User Authentication API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: User Authentication
paths:
  /api/v1/login:
    post:
      tags:
      - User Authentication
      summary: Palo Alto Networks Login with Username and Password
      description: Login with username and password
      operationId: processLogin
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/FormLoginRequest'
            examples:
              ProcessLoginRequestExample:
                summary: Default processLogin request
                x-microcks-default: true
                value:
                  username: soc-analyst
                  password: example-password
        required: true
      responses:
        '200':
          description: Login Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FormLoginResponse'
              examples:
                ProcessLogin200Example:
                  summary: Default processLogin 200 response
                  x-microcks-default: true
                  value:
                    token: fa9da05f5324df66e7df52a8ba08be8d
                    msspId: '437386'
                    message: On rule incident configured threat applied threat suspicious.
        '400':
          description: Bad request. One of the required arguments is missing or fails a constraint
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ProcessLogin400Example:
                  summary: Default processLogin 400 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ProcessLogin401Example:
                  summary: Default processLogin 401 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FormLoginResponse'
              examples:
                ProcessLogin429Example:
                  summary: Default processLogin 429 response
                  x-microcks-default: true
                  value:
                    token: fa9da05f5324df66e7df52a8ba08be8d
                    msspId: '437386'
                    message: On rule incident configured threat applied threat suspicious.
      x-public: 'true'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v1/mssp/{mssp-id}/token-refresh:
    get:
      tags:
      - User Authentication
      summary: Palo Alto Networks Refresh User JWT
      description: Refresh User JWT
      operationId: refreshToken
      parameters:
      - name: mssp-id
        in: path
        description: MSSP Id
        required: true
        schema:
          type: string
        example: '217742'
      responses:
        '200':
          description: Successful Operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenRefreshResponse'
              examples:
                RefreshToken200Example:
                  summary: Default refreshToken 200 response
                  x-microcks-default: true
                  value:
                    token: 89e1d118cd653806d56ad0072e459ad6
        '400':
          description: Bad request. One of the required arguments is missing or fails a constraint
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshToken400Example:
                  summary: Default refreshToken 400 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshToken401Example:
                  summary: Default refreshToken 401 response
                  x-microcks-default: true
                  value:
                    error:
                      code: example-code
                      message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                      target: example-target
                      details:
                      - code: example-code
                        message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                        target: example-target
                        details:
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
                        - code: example-code
                          message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
                          target: example-target
                          details:
                          - {}
                          - {}
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenRefreshResponse'
              examples:
                RefreshToken429Example:
                  summary: Default refreshToken 429 response
                  x-microcks-default: true
                  value:
                    token: 89e1d118cd653806d56ad0072e459ad6
      security:
      - UserJwt: []
      x-public: 'true'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    FormLoginResponse:
      type: object
      properties:
        token:
          type: string
          example: fa9da05f5324df66e7df52a8ba08be8d
        msspId:
          type: string
          example: '437386'
        message:
          type: string
          example: On rule incident configured threat applied threat suspicious.
    FormLoginRequest:
      required:
      - password
      - username
      type: object
      properties:
        username:
          type: string
          description: username of the user
          example: soc-analyst
        password:
          type: string
          description: password of the user
          example: example-password
    Error:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          example: example-code
        message:
          type: string
          example: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
        target:
          type: string
          example: example-target
        details:
          type: array
          items:
            $ref: '#/components/schemas/Error'
          example:
          - code: example-code
            message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
            target: example-target
            details:
            - code: example-code
              message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
              target: example-target
              details:
              - {}
              - {}
            - code: example-code
              message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule.
              target: example-target
              details:
              - {}
              - {}
    ErrorResponse:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
    TokenRefreshResponse:
      type: object
      properties:
        token:
          type: string
          example: 89e1d118cd653806d56ad0072e459ad6
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.