Palo Alto Networks Access Policies API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Access Policies API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Access Policies
  description: Access policy management for role-based access control.
paths:
  /access-policies:
    get:
      operationId: listAccessPolicies
      summary: Palo Alto Networks List Access Policies
      description: Returns the access policies defined for the tenant. Access policies bind a principal (service account or user) to a role within a specific TSG scope, controlling what API operations the principal can perform.
      tags:
      - Access Policies
      parameters:
      - name: principal_id
        in: query
        description: Filter policies by principal ID (service account or user).
        schema:
          type: string
        example: '179028'
      - name: tsg_id
        in: query
        description: Filter policies by TSG scope.
        schema:
          type: string
        example: '561662'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of policies to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Access policies returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/AccessPolicy'
              examples:
                ListAccessPolicies200Example:
                  summary: Default listAccessPolicies 200 response
                  x-microcks-default: true
                  value:
                    total: 216
                    offset: 770
                    limit: 432
                    items:
                    - id: example-id
                      principal_id: '228082'
                      principal_type: service_account
                      role_id: '930355'
                      role_name: Primary Policy 48
                      tsg_id: '568011'
                      created_at: '2025-08-17T04:28:20Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAccessPolicies401Example:
                  summary: Default listAccessPolicies 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAccessPolicies403Example:
                  summary: Default listAccessPolicies 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAccessPolicies500Example:
                  summary: Default listAccessPolicies 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAccessPolicy
      summary: Palo Alto Networks Create Access Policy
      description: Creates a new access policy binding a principal to a role within a TSG scope. The role determines which API operations the principal can perform on resources within the specified TSG.
      tags:
      - Access Policies
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessPolicyRequest'
            examples:
              CreateAccessPolicyRequestExample:
                summary: Default createAccessPolicy request
                x-microcks-default: true
                value:
                  principal_id: '988877'
                  principal_type: user
                  role_id: '955130'
                  tsg_id: '732912'
      responses:
        '201':
          description: Access policy created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessPolicy'
              examples:
                CreateAccessPolicy201Example:
                  summary: Default createAccessPolicy 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    principal_id: '228082'
                    principal_type: service_account
                    role_id: '930355'
                    role_name: Primary Policy 48
                    tsg_id: '568011'
                    created_at: '2025-08-17T04:28:20Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAccessPolicy400Example:
                  summary: Default createAccessPolicy 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAccessPolicy401Example:
                  summary: Default createAccessPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAccessPolicy403Example:
                  summary: Default createAccessPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAccessPolicy500Example:
                  summary: Default createAccessPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /access-policies/{id}:
    get:
      operationId: getAccessPolicy
      summary: Palo Alto Networks Get Access Policy
      description: Returns full details for a specific access policy.
      tags:
      - Access Policies
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the access policy.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Access policy details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessPolicy'
              examples:
                GetAccessPolicy200Example:
                  summary: Default getAccessPolicy 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    principal_id: '228082'
                    principal_type: service_account
                    role_id: '930355'
                    role_name: Primary Policy 48
                    tsg_id: '568011'
                    created_at: '2025-08-17T04:28:20Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAccessPolicy401Example:
                  summary: Default getAccessPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAccessPolicy403Example:
                  summary: Default getAccessPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Access policy not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAccessPolicy404Example:
                  summary: Default getAccessPolicy 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAccessPolicy500Example:
                  summary: Default getAccessPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAccessPolicy
      summary: Palo Alto Networks Update Access Policy
      description: Updates the role assignment for an existing access policy.
      tags:
      - Access Policies
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the access policy to update.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessPolicyRequest'
            examples:
              UpdateAccessPolicyRequestExample:
                summary: Default updateAccessPolicy request
                x-microcks-default: true
                value:
                  principal_id: '988877'
                  principal_type: user
                  role_id: '955130'
                  tsg_id: '732912'
      responses:
        '200':
          description: Access policy updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessPolicy'
              examples:
                UpdateAccessPolicy200Example:
                  summary: Default updateAccessPolicy 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    principal_id: '228082'
                    principal_type: service_account
                    role_id: '930355'
                    role_name: Primary Policy 48
                    tsg_id: '568011'
                    created_at: '2025-08-17T04:28:20Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateAccessPolicy400Example:
                  summary: Default updateAccessPolicy 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateAccessPolicy401Example:
                  summary: Default updateAccessPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateAccessPolicy403Example:
                  summary: Default updateAccessPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Access policy not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateAccessPolicy404Example:
                  summary: Default updateAccessPolicy 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateAccessPolicy500Example:
                  summary: Default updateAccessPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAccessPolicy
      summary: Palo Alto Networks Delete Access Policy
      description: Deletes an access policy, revoking the role binding from the principal.
      tags:
      - Access Policies
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the access policy to delete.
        schema:
          type: string
        example: example-id
      responses:
        '204':
          description: Access policy deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAccessPolicy401Example:
                  summary: Default deleteAccessPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAccessPolicy403Example:
                  summary: Default deleteAccessPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Access policy not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAccessPolicy404Example:
                  summary: Default deleteAccessPolicy 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAccessPolicy500Example:
                  summary: Default deleteAccessPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    AccessPolicyRequest:
      type: object
      required:
      - principal_id
      - principal_type
      - role_id
      - tsg_id
      properties:
        principal_id:
          type: string
          description: ID of the service account or user to grant access to.
          example: '988877'
        principal_type:
          type: string
          enum:
          - service_account
          - user
          description: Type of principal.
          example: user
        role_id:
          type: string
          description: ID of the role to assign.
          example: '955130'
        tsg_id:
          type: string
          description: TSG scope for this policy.
          example: '732912'
    AccessPolicy:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the access policy.
          example: example-id
        principal_id:
          type: string
          description: ID of the service account or user this policy applies to.
          example: '228082'
        principal_type:
          type: string
          enum:
          - service_account
          - user
          description: Type of principal.
          example: service_account
        role_id:
          type: string
          description: ID of the role assigned by this policy.
          example: '930355'
        role_name:
          type: string
          description: Name of the role assigned.
          example: Primary Policy 48
        tsg_id:
          type: string
          description: TSG scope this policy applies to.
          example: '568011'
        created_at:
          type: string
          format: date-time
          example: '2025-08-17T04:28:20Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Malware endpoint traffic incident on on traffic rule endpoint traffic.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 1e1e39dd-16dd-4699-a272-365b75e92268
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.