openapi: 3.1.0 info: title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend User Management API description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform. version: '1.0' contact: name: Palo Alto Networks Developer Support url: https://pan.dev/ license: name: Proprietary url: https://www.paloaltonetworks.com/legal servers: - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1 description: AIOps for NGFW BPA API production server. security: - oauth2Bearer: [] tags: - name: User Management paths: /api/v1/user/{username}/credential: put: tags: - User Management summary: Palo Alto Networks Change Password description: Change password for user operationId: resetPassword parameters: - name: username in: path description: Username required: true schema: maxLength: 128 minLength: 1 type: string example: jsmith requestBody: content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/ChangePasswordRequest' examples: ResetPasswordRequestExample: summary: Default resetPassword request x-microcks-default: true value: password: example-password required: true responses: '204': description: Successful operation '400': description: Bad password content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: ResetPassword400Example: summary: Default resetPassword 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Authentication error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: ResetPassword401Example: summary: Default resetPassword 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many api request security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v1/mssp/{mssp-id}/user/{username}: get: tags: - User Management summary: Palo Alto Networks Get User by Username description: Get User by username operationId: getUser parameters: - name: username in: path description: username of the user required: true schema: type: string example: jane.doe - name: mssp-id in: path description: the id of the MSSP of interest required: true schema: type: string example: '407542' responses: '200': description: User details for given username content: application/json: schema: $ref: '#/components/schemas/MsspUserResponse' examples: GetUser200Example: summary: Default getUser 200 response x-microcks-default: true value: username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 '400': description: Bad request. One of the required arguments is missing or fails a constraint content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: GetUser400Example: summary: Default getUser 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Authentication error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: GetUser401Example: summary: Default getUser 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '404': description: User not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: GetUser404Example: summary: Default getUser 404 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many requests content: application/json: schema: $ref: '#/components/schemas/MsspUserResponse' examples: GetUser429Example: summary: Default getUser 429 response x-microcks-default: true value: username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK put: tags: - User Management summary: Palo Alto Networks Update an Existing User description: Update an existing user operationId: updateUser parameters: - name: username in: path description: username of the user required: true schema: type: string example: soc-analyst - name: mssp-id in: path description: the id of the MSSP of interest required: true schema: type: string example: '105279' requestBody: content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/MsspUserRequest' examples: UpdateUserRequestExample: summary: Default updateUser request x-microcks-default: true value: username: jane.doe firstName: Primary Gateway 46 lastName: Corporate Gateway 06 required: true responses: '200': description: User updated successful content: application/json: schema: $ref: '#/components/schemas/MsspUserResponse' examples: UpdateUser200Example: summary: Default updateUser 200 response x-microcks-default: true value: username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 '400': description: Bad request. One of the required arguments is missing or fails a constraint content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: UpdateUser400Example: summary: Default updateUser 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Authentication error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: UpdateUser401Example: summary: Default updateUser 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '404': description: User not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: UpdateUser404Example: summary: Default updateUser 404 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many requests content: application/json: schema: $ref: '#/components/schemas/MsspUserResponse' examples: UpdateUser429Example: summary: Default updateUser 429 response x-microcks-default: true value: username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: tags: - User Management summary: Palo Alto Networks Delete an Existing User description: Delete an existing user operationId: deleteUser parameters: - name: username in: path description: Username of the user required: true schema: type: string example: jsmith - name: mssp-id in: path description: the id of the MSSP of interest required: true schema: type: string example: '241012' responses: '204': description: User deleted successful '400': description: Bad request. One of the required arguments is missing or fails a constraint content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: DeleteUser400Example: summary: Default deleteUser 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Authentication error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: DeleteUser401Example: summary: Default deleteUser 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '404': description: User not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: DeleteUser404Example: summary: Default deleteUser 404 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many requests security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v1/user/{username}/credential/reset-token/validate: post: tags: - User Management summary: Palo Alto Networks Validate Forgot Password Token description: Triggers the validation of a forgot password token and generating a special JWT upon successful validation of the forgot password token operationId: validateToken parameters: - name: username in: path description: Username required: true schema: maxLength: 128 minLength: 1 type: string example: jsmith requestBody: content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/ValidateTokenRequest' examples: ValidateTokenRequestExample: summary: Default validateToken request x-microcks-default: true value: resetToken: example-resetToken required: true responses: '200': description: Successful operation content: application/json: schema: $ref: '#/components/schemas/ValidateTokenResponse' examples: ValidateToken200Example: summary: Default validateToken 200 response x-microcks-default: true value: token: 4c53e5f5a41d0f448065561d370f7834 '400': description: Bad request token / Request token expired content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: ValidateToken400Example: summary: Default validateToken 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many api request content: application/json: schema: $ref: '#/components/schemas/ValidateTokenResponse' examples: ValidateToken429Example: summary: Default validateToken 429 response x-microcks-default: true value: token: 4c53e5f5a41d0f448065561d370f7834 x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v1/mssp/{mssp-id}/user: get: tags: - User Management summary: Palo Alto Networks List Users description: List users for given mssp console operationId: listUsers parameters: - name: next_page_token in: query description: Token to fetch next page. Max pagesize is 60. required: false schema: type: string example: example-next_page_token - name: mssp-id in: path description: The id of the MSSP of interest required: true schema: type: string example: '309330' responses: '200': description: List of users content: application/json: schema: $ref: '#/components/schemas/MsspListUserResponse' examples: ListUsers200Example: summary: Default listUsers 200 response x-microcks-default: true value: value: - username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 - username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 nextPageToken: example-nextPageToken '400': description: Bad request. One of the required arguments is missing or fails a constraint content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: ListUsers400Example: summary: Default listUsers 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Authentication error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: ListUsers401Example: summary: Default listUsers 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many requests content: application/json: schema: $ref: '#/components/schemas/MsspListUserResponse' examples: ListUsers429Example: summary: Default listUsers 429 response x-microcks-default: true value: value: - username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 - username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 nextPageToken: example-nextPageToken security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK post: tags: - User Management summary: Palo Alto Networks Create a New User description: Create a new user under a specific MSSP account operationId: createUser parameters: - name: mssp-id in: path description: the id of the MSSP of interest required: true schema: type: string example: '604843' requestBody: content: application/json; charset=UTF-8: schema: $ref: '#/components/schemas/MsspUserRequest' examples: CreateUserRequestExample: summary: Default createUser request x-microcks-default: true value: username: jane.doe firstName: Primary Gateway 46 lastName: Corporate Gateway 06 required: true responses: '201': description: User created successful content: application/json: schema: $ref: '#/components/schemas/MsspUserResponse' examples: CreateUser201Example: summary: Default createUser 201 response x-microcks-default: true value: username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 '400': description: Bad request. One of the required arguments is missing or fails a constraint content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: CreateUser400Example: summary: Default createUser 400 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '401': description: Authentication error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: CreateUser401Example: summary: Default createUser 401 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '409': description: Conflicting username found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: CreateUser409Example: summary: Default createUser 409 response x-microcks-default: true value: error: code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} '429': description: Too many requests content: application/json: schema: $ref: '#/components/schemas/MsspUserResponse' examples: CreateUser429Example: summary: Default createUser 429 response x-microcks-default: true value: username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 security: - UserJwt: [] x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v1/user/{username}/credential/reset-token: get: tags: - User Management summary: Palo Alto Networks Generate Password Reset Token description: Triggers the forgot password flow where a password reset token is emailed to a validated user operationId: resetToken parameters: - name: username in: path description: Username required: true schema: maxLength: 128 minLength: 1 type: string example: jsmith responses: '204': description: Successful operation '429': description: Too many api request x-public: 'true' x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: ValidateTokenResponse: type: object properties: token: type: string description: Reset Password Restricted JWT example: 4c53e5f5a41d0f448065561d370f7834 ValidateTokenRequest: required: - resetToken type: object properties: resetToken: type: string description: Reset password token example: example-resetToken ChangePasswordRequest: required: - password type: object properties: password: type: string description: New Password example: example-password MsspUserRequest: required: - firstName - lastName - username type: object properties: username: maxLength: 128 minLength: 1 type: string description: User name of the user. example: jane.doe firstName: maxLength: 63 minLength: 1 type: string description: First name of the user. example: Primary Gateway 46 lastName: maxLength: 63 minLength: 1 type: string description: Last name of the user. example: Corporate Gateway 06 Error: required: - code - message type: object properties: code: type: string example: example-code message: type: string example: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: type: string example: example-target details: type: array items: $ref: '#/components/schemas/Error' example: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} - code: example-code message: Incident malware violation firewall endpoint investigation firewall network rule blocked activity rule. target: example-target details: - {} - {} MsspListUserResponse: type: object properties: value: type: array items: $ref: '#/components/schemas/MsspUserResponse' example: - username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 - username: jane.doe firstName: Production Agent 01 lastName: Primary Agent 97 lastModifiedBy: example-lastModifiedBy lastModifiedAt: 578 nextPageToken: type: string example: example-nextPageToken ErrorResponse: required: - error type: object properties: error: $ref: '#/components/schemas/Error' MsspUserResponse: type: object properties: username: type: string example: jane.doe firstName: type: string example: Production Agent 01 lastName: type: string example: Primary Agent 97 lastModifiedBy: type: string example: example-lastModifiedBy lastModifiedAt: type: integer format: int64 example: 578 securitySchemes: oauth2Bearer: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.