Palo Alto Networks BPA Reports API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend BPA Reports API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: BPA Reports
  description: Completed assessment report retrieval.
paths:
  /reports/{report_id}:
    get:
      operationId: getBPAReport
      summary: Palo Alto Networks Get BPA Report
      description: Returns the completed Best Practice Assessment report for a device. The report includes an overall score, category-level scores, pass and fail summaries, and a prioritized list of recommendations for improving the device's security posture against PAN-OS best practices.
      tags:
      - BPA Reports
      parameters:
      - name: report_id
        in: path
        required: true
        description: Unique identifier of the BPA report.
        schema:
          type: string
        example: '966889'
      responses:
        '200':
          description: BPA report returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BPAReport'
              examples:
                GetBpareport200Example:
                  summary: Default getBPAReport 200 response
                  x-microcks-default: true
                  value:
                    report_id: '250039'
                    request_id: 9512acfa-8bcf-4c16-b52c-b00b20d8bf8d
                    serial_number: D44EF27DA5D9
                    pan_os_version: 10.6.9
                    overall_score: 52.32
                    category_scores:
                    - category: standard
                      score: 90.68
                      passed: 768
                      failed: 933
                      not_applicable: 433
                    total_checks: 185
                    passed_checks: 690
                    failed_checks: 850
                    generated_at: '2024-04-04T12:31:31Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareport401Example:
                  summary: Default getBPAReport 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareport403Example:
                  summary: Default getBPAReport 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '404':
          description: Report not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareport404Example:
                  summary: Default getBPAReport 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareport500Example:
                  summary: Default getBPAReport 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /reports/{report_id}/checks:
    get:
      operationId: getBPAReportChecks
      summary: Palo Alto Networks Get BPA Report Check Details
      description: Returns the individual check results from a BPA report. Each check corresponds to a specific best practice recommendation and includes its pass/fail status, current configuration state, and remediation guidance. Supports filtering by category and status.
      tags:
      - BPA Reports
      parameters:
      - name: report_id
        in: path
        required: true
        description: Unique identifier of the BPA report.
        schema:
          type: string
        example: '101187'
      - name: category
        in: query
        description: Filter checks by best practice category.
        schema:
          type: string
          enum:
          - device_management
          - security_policies
          - nat_policies
          - decryption
          - threat_prevention
          - url_filtering
          - wildfire
          - dns_security
          - globalprotect
        example: globalprotect
      - name: status
        in: query
        description: Filter checks by result status.
        schema:
          type: string
          enum:
          - pass
          - fail
          - not_applicable
        example: pass
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of checks to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: BPA report checks returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/BPACheck'
              examples:
                GetBpareportChecks200Example:
                  summary: Default getBPAReportChecks 200 response
                  x-microcks-default: true
                  value:
                    total: 596
                    offset: 841
                    limit: 279
                    items:
                    - check_id: '147583'
                      category: standard
                      name: Branch Firewall 76
                      description: Malware investigation on policy blocked endpoint rule threat.
                      status: not_applicable
                      severity: high
                      current_value: example-current_value
                      recommended_value: example-recommended_value
                      remediation: example-remediation
                      references:
                      - https://vpn.example.com/858ba3
                      - https://login.acme-systems.org/a6c881
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareportChecks400Example:
                  summary: Default getBPAReportChecks 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareportChecks401Example:
                  summary: Default getBPAReportChecks 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareportChecks403Example:
                  summary: Default getBPAReportChecks 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '404':
          description: Report not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareportChecks404Example:
                  summary: Default getBPAReportChecks 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetBpareportChecks500Example:
                  summary: Default getBPAReportChecks 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Violation alert configured endpoint policy policy policy.
                    request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    BPACheck:
      type: object
      properties:
        check_id:
          type: string
          description: Unique identifier of the check.
          example: '147583'
        category:
          type: string
          description: Best practice category this check belongs to.
          example: standard
        name:
          type: string
          description: Name of the best practice check.
          example: Branch Firewall 76
        description:
          type: string
          description: Description of what this check evaluates.
          example: Malware investigation on policy blocked endpoint rule threat.
        status:
          type: string
          enum:
          - pass
          - fail
          - not_applicable
          description: Result status of this check.
          example: not_applicable
        severity:
          type: string
          enum:
          - informational
          - low
          - medium
          - high
          - critical
          description: Severity if this check fails.
          example: high
        current_value:
          type: string
          description: Current configuration value found on the device.
          example: example-current_value
        recommended_value:
          type: string
          description: Recommended configuration value per best practices.
          example: example-recommended_value
        remediation:
          type: string
          description: Step-by-step remediation guidance for failed checks.
          example: example-remediation
        references:
          type: array
          items:
            type: string
            format: uri
          description: Reference URLs with additional guidance.
          example:
          - https://vpn.example.com/858ba3
          - https://login.acme-systems.org/a6c881
    BPAReport:
      type: object
      properties:
        report_id:
          type: string
          description: Unique identifier of the report.
          example: '250039'
        request_id:
          type: string
          description: ID of the BPA request that generated this report.
          example: 9512acfa-8bcf-4c16-b52c-b00b20d8bf8d
        serial_number:
          type: string
          description: Device serial number assessed.
          example: D44EF27DA5D9
        pan_os_version:
          type: string
          description: PAN-OS version assessed.
          example: 10.6.9
        overall_score:
          type: number
          format: float
          description: Overall best practice compliance score from 0.0 to 100.0.
          minimum: 0.0
          maximum: 100.0
          example: 52.32
        category_scores:
          type: array
          description: Compliance scores broken down by best practice category.
          items:
            type: object
            properties:
              category:
                type: string
                description: Best practice category name.
                example: standard
              score:
                type: number
                format: float
                description: Category compliance score (0.0 to 100.0).
                example: 15.77
              passed:
                type: integer
                description: Number of checks that passed in this category.
                example: 249
              failed:
                type: integer
                description: Number of checks that failed in this category.
                example: 83
              not_applicable:
                type: integer
                description: Number of checks not applicable to this device.
                example: 429
          example:
          - category: standard
            score: 90.68
            passed: 768
            failed: 933
            not_applicable: 433
        total_checks:
          type: integer
          description: Total number of checks evaluated.
          example: 185
        passed_checks:
          type: integer
          description: Number of checks that passed.
          example: 690
        failed_checks:
          type: integer
          description: Number of checks that failed.
          example: 850
        generated_at:
          type: string
          format: date-time
          description: Timestamp when the report was generated.
          example: '2024-04-04T12:31:31Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Violation alert configured endpoint policy policy policy.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: e0526af9-36bf-48c4-80c9-db1fb17c933f
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.