Palo Alto Networks Apps API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Apps API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Apps
  description: SaaS application onboarding and management.
paths:
  /v1/apps:
    get:
      operationId: listOnboardedApps
      summary: Palo Alto Networks List Onboarded SaaS Applications
      description: Returns the list of SaaS applications that have been onboarded to SSPM for posture assessment. Each entry includes the application type, connection status, and summary counts of posture check results by severity.
      tags:
      - Apps
      parameters:
      - name: status
        in: query
        description: Filter applications by connection status.
        schema:
          type: string
          enum:
          - connected
          - disconnected
          - pending
          - error
        example: disconnected
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of applications to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Onboarded applications returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/OnboardedApp'
              examples:
                ListOnboardedApps200Example:
                  summary: Default listOnboardedApps 200 response
                  x-microcks-default: true
                  value:
                    total: 694
                    offset: 752
                    limit: 416
                    items:
                    - app_id: '621838'
                      app_type: standard
                      display_name: Sarah Doe
                      status: error
                      tenant_id: tenant-34be8834
                      check_summary: &id001
                        critical: 904
                        high: 463
                        medium: 193
                        low: 762
                        pass: 336
                      last_scanned_at: '2026-06-23T07:17:30Z'
                      onboarded_at: '2026-07-05T03:34:39Z'
                    - app_id: '621838'
                      app_type: standard
                      display_name: Sarah Doe
                      status: error
                      tenant_id: tenant-34be8834
                      check_summary: *id001
                      last_scanned_at: '2026-06-23T07:17:30Z'
                      onboarded_at: '2026-07-05T03:34:39Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps400Example:
                  summary: Default listOnboardedApps 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps401Example:
                  summary: Default listOnboardedApps 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps403Example:
                  summary: Default listOnboardedApps 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps500Example:
                  summary: Default listOnboardedApps 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: onboardApp
      summary: Palo Alto Networks Onboard New Application
      description: Onboards a new SaaS application to SSPM for posture assessment. Requires specifying the application type and providing the OAuth consent or API credentials needed to connect to the application. After onboarding, SSPM performs an initial posture scan.
      tags:
      - Apps
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OnboardAppRequest'
            examples:
              OnboardAppRequestExample:
                summary: Default onboardApp request
                x-microcks-default: true
                value:
                  app_type: standard
                  display_name: Alex Garcia
                  credentials: {}
      responses:
        '201':
          description: Application onboarded successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OnboardedApp'
              examples:
                OnboardApp201Example:
                  summary: Default onboardApp 201 response
                  x-microcks-default: true
                  value:
                    app_id: '621838'
                    app_type: standard
                    display_name: Sarah Doe
                    status: error
                    tenant_id: tenant-34be8834
                    check_summary:
                      critical: 904
                      high: 463
                      medium: 193
                      low: 762
                      pass: 336
                    last_scanned_at: '2026-06-23T07:17:30Z'
                    onboarded_at: '2026-07-05T03:34:39Z'
        '400':
          description: Invalid request body or unsupported application type.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp400Example:
                  summary: Default onboardApp 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp401Example:
                  summary: Default onboardApp 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp403Example:
                  summary: Default onboardApp 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '409':
          description: Application of this type is already onboarded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp409Example:
                  summary: Default onboardApp 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp500Example:
                  summary: Default onboardApp 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/apps/{app_id}:
    delete:
      operationId: removeApp
      summary: Palo Alto Networks Remove Onboarded Application
      description: Removes a previously onboarded SaaS application from SSPM. This stops posture scanning for the application and removes all associated check results. This action cannot be undone.
      tags:
      - Apps
      parameters:
      - name: app_id
        in: path
        required: true
        description: Unique identifier of the onboarded application.
        schema:
          type: string
        example: '293827'
      responses:
        '204':
          description: Application removed successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp401Example:
                  summary: Default removeApp 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp403Example:
                  summary: Default removeApp 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '404':
          description: Application not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp404Example:
                  summary: Default removeApp 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp500Example:
                  summary: Default removeApp 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    OnboardedApp:
      type: object
      properties:
        app_id:
          type: string
          description: Unique identifier for the onboarded application.
          example: '621838'
        app_type:
          type: string
          description: Application type identifier (e.g., google_workspace, microsoft_365).
          example: standard
        display_name:
          type: string
          description: Human-readable name for the onboarded application instance.
          example: Sarah Doe
        status:
          type: string
          enum:
          - connected
          - disconnected
          - pending
          - error
          description: Current connection status.
          example: error
        tenant_id:
          type: string
          description: Tenant or domain identifier within the SaaS application.
          example: tenant-34be8834
        check_summary:
          type: object
          description: Summary counts of posture check results by severity.
          properties:
            critical:
              type: integer
              example: 195
            high:
              type: integer
              example: 699
            medium:
              type: integer
              example: 127
            low:
              type: integer
              example: 223
            pass:
              type: integer
              example: 442
          example:
            critical: 904
            high: 463
            medium: 193
            low: 762
            pass: 336
        last_scanned_at:
          type: string
          format: date-time
          description: Timestamp of the most recent posture scan.
          example: '2026-06-23T07:17:30Z'
        onboarded_at:
          type: string
          format: date-time
          description: Timestamp when the application was onboarded.
          example: '2026-07-05T03:34:39Z'
    OnboardAppRequest:
      type: object
      required:
      - app_type
      properties:
        app_type:
          type: string
          description: Application type to onboard (e.g., google_workspace, microsoft_365, salesforce).
          example: standard
        display_name:
          type: string
          description: Optional display name for this application instance.
          example: Alex Garcia
        credentials:
          type: object
          description: Authentication credentials required to connect to the application.
          additionalProperties: true
          example: {}
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Malware violation rule blocked detected endpoint policy detected.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.