openapi: 3.1.0 info: title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Vlan Attachment API description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform. version: '1.0' contact: name: Palo Alto Networks Developer Support url: https://pan.dev/ license: name: Proprietary url: https://www.paloaltonetworks.com/legal servers: - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1 description: AIOps for NGFW BPA API production server. security: - oauth2Bearer: [] tags: - name: Vlan Attachment paths: /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments: get: tags: - Vlan Attachment summary: Palo Alto Networks List Vlan Attachments description: Retrieve all virtual circuits configured within a specific Interconnect. This allows administrators to verify the regional distribution of attachments and their current BGP states. Use this when auditing high-availability (HA) domains or verifying pairing key availability. The response lists BGP parameters, edge availability domains, and current provisioning states for each circuit. parameters: - name: interconnectId in: path required: true schema: type: string example: '400911' responses: '200': description: Success content: application/json: examples: Get vlan attachments in an interconnect: value: data: - bfdEnabled: false bgpPeerAsn: 16363 bgpPeerBfdSessionInitMode: DISABLED bgpPeerMd5AuthEnabled: false createTime: 1758575564100 edgeAvailability: AVAILABILITY_DOMAIN_2 id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b name: test-2 permittedActions: [] stackType: IPV4_ONLY state: NOT_STARTED status: INACTIVE tenantCount: 0 updateTime: 1758575564106 - bfdEnabled: false bgpPeerAsn: 16363 bgpPeerBfdSessionInitMode: DISABLED bgpPeerMd5AuthEnabled: false createTime: 1758575564075 edgeAvailability: AVAILABILITY_DOMAIN_1 id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e name: test-1 permittedActions: [] stackType: IPV4_ONLY state: NOT_STARTED status: INACTIVE tenantCount: 0 updateTime: 1758575564082 requestId: 21f951d8-0d34-48cb-ae3e-29fcc5339bea '400': description: Bad Request '500': description: Server Error operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachments x-microcks-operation: delay: 0 dispatcher: FALLBACK post: tags: - Vlan Attachment summary: Palo Alto Networks Provision Vlan Attachment description: Create a new virtual circuit, known as a VlanAttachment, within an Interconnect to enable data transfer. This establishes the actual logical path for Prisma Access traffic routing through the Service Provider. Deploy this when initializing new egress paths or adding redundant links for regional reliability. Required parameters include a unique name, BGP Peer ASN, and BFD initialization mode to ensure robust connectivity. parameters: - name: interconnectId in: path required: true schema: type: string example: '122475' requestBody: content: application/json: schema: $ref: '#/components/schemas/VlanAttachmentRequest' examples: Create Partner VLAN attachment: value: name: test bgpPeerAsn: 16550 bgpPeerBfdSessionInitMode: DISABLED stackType: IPV4_ONLY bgpPeerMd5AuthEnabled: false Create VLAN attachment with BFD enabled: value: name: bfd-conn bgpPeerAsn: 65001 bgpPeerBfdSessionInitMode: ACTIVE bgpPeerBfdMinTransmitInterval: 1000 bgpPeerBfdMinReceiveInterval: 1000 bgpPeerBfdMultiplier: 5 stackType: IPV4_ONLY bgpPeerMd5AuthEnabled: true Create VLAN attachment with IPv4/IPv6: value: name: dual-stack bgpPeerAsn: 64512 bgpPeerBfdSessionInitMode: PASSIVE stackType: IPV4_IPV6 bgpPeerMd5AuthEnabled: false Create Dedicated VLAN attachment: value: name: ded-vlan bgpPeerAsn: 16363 bgpPeerBfdSessionInitMode: ACTIVE bandwidth: BPS_10G stackType: IPV4_ONLY bgpPeerMd5AuthEnabled: true dedicatedConnectionDetails: - edgeAvailability: ZONE1 bandwidth: BPS_10G - edgeAvailability: ZONE2 bandwidth: BPS_10G Create VLAN attachment with custom IP addresses: value: name: custom-ip-vlan bgpPeerAsn: 65001 bgpPeerBfdSessionInitMode: ACTIVE stackType: IPV4_ONLY bgpPeerMd5AuthEnabled: false primaryAttachmentCustomIpAddress: candidateCloudRouterIpAddress: 169.254.1.1/29 candidateCustomerRouterIpAddress: 169.254.1.2/29 redundantAttachmentCustomIpAddress: candidateCloudRouterIpAddress: 169.254.2.1/29 candidateCustomerRouterIpAddress: 169.254.2.2/29 required: true responses: '201': description: Success content: application/json: examples: Add vlan attachment in interconnect: value: data: - bfdEnabled: false bgpPeerAsn: 16363 bgpPeerBfdSessionInitMode: DISABLED bgpPeerMd5AuthEnabled: false createTime: 1758575564075 edgeAvailability: AVAILABILITY_DOMAIN_1 id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e name: test-1 permittedActions: [] stackType: IPV4_ONLY state: NOT_STARTED status: INACTIVE tenantCount: 0 updateTime: 1758575564077 - bfdEnabled: false bgpPeerAsn: 16363 bgpPeerBfdSessionInitMode: DISABLED bgpPeerMd5AuthEnabled: false createTime: 1758575564100 edgeAvailability: AVAILABILITY_DOMAIN_2 id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b name: test-2 permittedActions: [] stackType: IPV4_ONLY state: NOT_STARTED status: INACTIVE tenantCount: 0 updateTime: 1758575564101 requestId: 73811958-f1a9-4a3e-b5f1-b9373eeb4000 Add vlan attachment with custom IP addresses: value: data: - bfdEnabled: false bgpPeerAsn: 65001 bgpPeerBfdSessionInitMode: ACTIVE bgpPeerMd5AuthEnabled: false createTime: 1758575564075 edgeAvailability: AVAILABILITY_DOMAIN_1 id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e name: custom-ip-vlan-1 permittedActions: [] stackType: IPV4_ONLY state: NOT_STARTED status: INACTIVE tenantCount: 0 updateTime: 1758575564077 customIpAddress: candidateCloudRouterIpAddress: 169.254.1.1/29 candidateCustomerRouterIpAddress: 169.254.1.2/29 - bfdEnabled: false bgpPeerAsn: 65001 bgpPeerBfdSessionInitMode: ACTIVE bgpPeerMd5AuthEnabled: false createTime: 1758575564100 edgeAvailability: AVAILABILITY_DOMAIN_2 id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b name: custom-ip-vlan-2 permittedActions: [] stackType: IPV4_ONLY state: NOT_STARTED status: INACTIVE tenantCount: 0 updateTime: 1758575564101 customIpAddress: candidateCloudRouterIpAddress: 169.254.2.1/29 candidateCustomerRouterIpAddress: 169.254.2.2/29 requestId: 73811958-f1a9-4a3e-b5f1-b9373eeb4000 '404': description: Not Found content: application/json: examples: Add vlan attachment, interconnect not found: value: error: errorCode: 52008 errorType: VALIDATION_ERROR httpStatus: 404 msg: Interconnect not found requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b '400': description: Bad Request content: application/json: examples: VLAN attachment name exists: value: error: errorCode: 52011 errorType: VALIDATION_ERROR httpStatus: 400 msg: Connection name already exists requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890 Max vlan attachments reached: value: error: errorCode: 52018 errorType: VALIDATION_ERROR httpStatus: 400 msg: Reached maximum number of vlan attachments in an interconnect requestId: b2c3d4e5-6f78-9012-bcde-f12345678901 Dedicated connection details missing: value: error: errorCode: 52025 errorType: VALIDATION_ERROR httpStatus: 400 msg: dedicatedVlanAttachmentDetails cannot be null for Connection with type DEDICATED requestId: c3d4e5f6-7890-1234-cdef-012345678901 Bandwidth required for dedicated: value: error: errorCode: 52026 errorType: VALIDATION_ERROR httpStatus: 400 msg: Bandwidth is required input for dedicated VLAN Attachment requestId: d4e5f678-9012-3456-def0-123456789012 Invalid custom IP addresses: value: error: errorCode: 52027 errorType: VALIDATION_ERROR httpStatus: 400 msg: Cloud Router IP and Peer IP must both be set or must both be unset. If set, the prefix lengths must be the same, IP addresses must not be in reserved ranges, and must not be network or broadcast addresses. requestId: e6f78901-2345-6789-0123-456789012345 '500': description: Server Error operationId: PostMtSp-interconnectInterconnectsBy_interconnectidVlan-attachments x-microcks-operation: delay: 0 dispatcher: FALLBACK /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}: get: tags: - Vlan Attachment summary: Palo Alto Networks Get Vlan Attachment description: View the full technical specification of a single virtual circuit by its unique identifier. This displays parameters such as MD5 authentication, BGP session timers, and stack type (IPv4/Dual-Stack). Use this to verify pairing key generation or to inspect the specific edge availability domain assigned for redundancy. The returned data provides the exact state needed for alignment with service provider configurations. parameters: - name: interconnectId in: path required: true schema: type: string example: '352666' - name: vlanAttachmentId in: path required: true schema: type: string example: '197660' responses: '200': description: Success content: application/json: examples: Get vlan attachment by Id: value: data: bandwidth: BPS_50M bgpPeerAsn: 16550 edgeAvailability: ZONE1 id: dee52272-d1e2-4b88-9ebc-a5e70e414d58 name: abc-edge-1 partnerEmail: sp@mail.com partnerName: sp_abc_name region: us-central1 state: CREATED_CONNECTION status: PENDING bgpPeerBfdMinReceiveInterval: 1000 bgpPeerBfdMinTransmitInterval: 1000 bgpPeerBfdMultiplier: 5 bgpPeerMd5AuthEnabled: true requestId: 138de731-25c2-4001-8ea5-d81992c146d7 '400': description: Bad Request '500': description: Server Error operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentid x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: tags: - Vlan Attachment summary: Palo Alto Networks Delete Vlan Attachment description: Permanently remove a specific virtual circuit and its logical configuration from the Interconnect. Terminating these circuits is necessary when network paths are being replaced or retired. Execute this during scheduled maintenance windows or regional re-architecting. Ensure the paired service provider resource is also manually decommissioned to prevent unintended billing. parameters: - name: interconnectId in: path required: true schema: type: string example: '106065' - name: vlanAttachmentId in: path required: true schema: type: string example: '238900' responses: '200': description: Success content: application/json: examples: Delete vlan attachment by Id: value: data: Successfully delete VLAN Attachment requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9 '404': description: Not Found content: application/json: examples: Delete vlan attachment, interconnect not found: value: error: errorCode: 52008 errorType: VALIDATION_ERROR httpStatus: 404 msg: Interconnect not found requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94 '400': description: Bad Request '500': description: Server Error operationId: DeleteMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentid x-microcks-operation: delay: 0 dispatcher: FALLBACK /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}/accept: post: tags: - Vlan Attachment summary: Palo Alto Networks Accept AWS Attachment description: Transition a pending AWS Direct Connect attachment into the accepted state within the management plane. This serves as the final confirmation required by AWS to activate the virtual circuit. Trigger this action when the circuit state reaches PENDING_SP_ACCEPTANCE in the AWS console. Note that this action is exclusive to AWS deployments and cannot be used for GCP or other providers. parameters: - name: interconnectId in: path required: true schema: type: string example: '681643' - name: vlanAttachmentId in: path required: true schema: type: string example: '689952' responses: '200': description: Success content: application/json: examples: Accept AWS vlan attachment: value: data: Successfully accepted VLAN Attachment requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9 '400': description: Bad Request content: application/json: examples: Accept non-AWS vlan attachment: value: error: errorCode: 52047 errorType: VALIDATION_ERROR httpStatus: 400 msg: Connections created in AWS can be accepted requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b Accept vlan attachment not in pending state: value: error: errorCode: 52046 errorType: VALIDATION_ERROR httpStatus: 400 msg: VlanAttachment can be accepted only in PENDING_SP_ACCEPTANCE state requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890 '404': description: Not Found content: application/json: examples: Interconnect not found: value: error: errorCode: 52008 errorType: VALIDATION_ERROR httpStatus: 404 msg: Interconnect not found requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94 Vlan attachment not found: value: error: errorCode: 52029 errorType: VALIDATION_ERROR httpStatus: 404 msg: Vlan Attachment not found requestId: cf32af05-7df6-4dd2-b27e-7b6ef2683145 '500': description: Server Error content: application/json: examples: Accept AWS vlan attachment failed: value: error: errorCode: 52048 errorType: INTERNAL_ERROR httpStatus: 500 msg: Failed to accept vlan attachment in aws requestId: d42dba1a-23f1-4818-813b-2da9f35c95bb operationId: PostMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentidAccept x-microcks-operation: delay: 0 dispatcher: FALLBACK /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}/logs: get: tags: - Vlan Attachment summary: Palo Alto Networks Get GCP CloudRouter Logs description: Get GCP cloudRouter logs for vlan attachment from startTime to endTime milliseconds. parameters: - name: interconnectId in: path required: true schema: type: string example: '362191' - name: vlanAttachmentId in: path required: true schema: type: string example: '633509' - name: duration in: query description: 'Duration for logs. Allowed values: 15m, 1h, 1d, 3d' schema: type: string default: 1d enum: - 15m - 1h - 1d - 3d example: 1d responses: '200': description: Success content: application/json: examples: Get cloud router logs: value: data: logs: - timestamp: 1758576695399 severity: INFO message: BGP session established with peer 10.0.0.1 - timestamp: 1758576779732 severity: WARNING message: BGP hold timer expired, resetting session requestId: 82923271-2db3-4895-b1cf-a5faa77d28e3 '400': description: Bad Request content: application/json: examples: Invalid duration: value: error: errorCode: 52091 errorType: VALIDATION_ERROR httpStatus: 400 msg: Invalid duration, allowed duration are 15m, 1h, 1d, 3d requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b Logs not supported for AWS: value: error: errorCode: 52092 errorType: VALIDATION_ERROR httpStatus: 400 msg: CloudRouter logs supported only for GCP connections requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890 '500': description: Server Error content: application/json: examples: Failed to get logs: value: error: errorCode: 52090 errorType: INTERNAL_ERROR httpStatus: 500 msg: Failed getting cloud router logs from GCP requestId: d42dba1a-23f1-4818-813b-2da9f35c95bb operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentidLogs x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: VlanAttachmentRequest: type: object required: - name - bgpPeerAsn - bgpPeerBfdSessionInitMode properties: name: type: string pattern: ^([-0-9a-z]){1,13}$ example: Production Agent 71 stackType: $ref: '#/components/schemas/StackType' bandwidth: $ref: '#/components/schemas/Bandwidth' bgpPeerAsn: type: integer format: int64 minimum: 1 example: 63 bgpPeerBfdSessionInitMode: $ref: '#/components/schemas/SessionInitializationMode' bgpPeerBfdMinTransmitInterval: type: integer format: int64 maximum: 30000 minimum: 1000 example: 10043 bgpPeerBfdMinReceiveInterval: type: integer format: int64 maximum: 30000 minimum: 1000 example: 12651 bgpPeerBfdMultiplier: type: integer format: int64 maximum: 16 minimum: 5 example: 5 dedicatedConnectionDetails: type: array items: $ref: '#/components/schemas/DedicatedVlanAttachmentDetailsEntry' example: - edgeAvailability: example-edgeAvailability bandwidth: BPS_300M - edgeAvailability: example-edgeAvailability bandwidth: BPS_50M primaryAttachmentCustomIpAddress: $ref: '#/components/schemas/VlanAttachmentCustomIpAddress' redundantAttachmentCustomIpAddress: $ref: '#/components/schemas/VlanAttachmentCustomIpAddress' bgpPeerMd5AuthEnabled: type: boolean example: true SessionInitializationMode: type: string enum: - ACTIVE - PASSIVE - DISABLED StackType: type: string enum: - IPV4_ONLY - IPV4_IPV6 Bandwidth: type: string enum: - BPS_50M - BPS_100M - BPS_200M - BPS_300M - BPS_400M - BPS_500M - BPS_1G - BPS_2G - BPS_5G - BPS_10G DedicatedVlanAttachmentDetailsEntry: type: object properties: edgeAvailability: type: string example: example-edgeAvailability bandwidth: $ref: '#/components/schemas/Bandwidth' required: - edgeAvailability VlanAttachmentCustomIpAddress: type: object description: Custom IP address configuration for VLAN attachment BGP peering. Both Cloud Router and Customer Router IP addresses must be provided together with matching prefix lengths (/29 or /30). IP addresses must not be in reserved ranges (RFC1918 private IPs, loopback, etc.) and must not be network or broadcast addresses. properties: candidateCloudRouterIpAddress: type: string description: Cloud Router IP address in CIDR notation (e.g., 169.254.1.1/29). Must have prefix length /29 or /30 and match the prefix length of candidateCustomerRouterIpAddress. pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))/(29|30)$ example: 10.163.80.221 candidateCustomerRouterIpAddress: type: string description: Customer Router IP address in CIDR notation (e.g., 169.254.1.2/29). Must have prefix length /29 or /30 and match the prefix length of candidateCloudRouterIpAddress. pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))/(29|30)$ example: 10.34.238.244 securitySchemes: oauth2Bearer: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.