Best Practice Assessment request submission and status tracking.
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-bpa-requests-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Palo Alto Networks AIOps for NGFW BPA BPA Requests API
description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
version: '1.0'
contact:
name: Palo Alto Networks Developer Support
url: https://pan.dev/
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: BPA Requests
description: Best Practice Assessment request submission and status tracking.
paths:
/requests:
post:
operationId: submitBPARequest
summary: Palo Alto Networks Submit BPA Request
description: Submits a Best Practice Assessment request for a specific NGFW device. The request requires the device serial number, PAN-OS version, and optional device information. The assessment runs asynchronously; use the returned request ID to check status and retrieve the report when complete.
tags:
- BPA Requests
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/BPARequest'
examples:
SubmitBparequestRequestExample:
summary: Default submitBPARequest request
x-microcks-default: true
value:
serial_number: 4B89BF130877
version: 9.6.8
device_info:
hostname: host-f367
model: VM-300
deployment_type: vm
responses:
'201':
description: BPA request submitted successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/BPARequestStatus'
examples:
SubmitBparequest201Example:
summary: Default submitBPARequest 201 response
x-microcks-default: true
value:
request_id: f629a7fb-33c3-4361-a3f4-c438e2f4f747
serial_number: 94C0577F8429
status: processing
report_id: '336271'
error_message: example-error_message
submitted_at: '2025-11-24T06:05:16Z'
completed_at: '2024-08-27T07:28:12Z'
'400':
description: Invalid request body or unsupported PAN-OS version.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
SubmitBparequest400Example:
summary: Default submitBPARequest 400 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
SubmitBparequest401Example:
summary: Default submitBPARequest 401 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'403':
description: Insufficient permissions or device not registered to this tenant.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
SubmitBparequest403Example:
summary: Default submitBPARequest 403 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'409':
description: A BPA request is already in progress for this device.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
SubmitBparequest409Example:
summary: Default submitBPARequest 409 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
SubmitBparequest500Example:
summary: Default submitBPARequest 500 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/requests/{request_id}:
get:
operationId: getBPARequestStatus
summary: Palo Alto Networks Check BPA Request Status
description: Returns the current processing status of a submitted BPA request. When the status is completed, the response includes the report ID which can be used to retrieve the full assessment report. Request records are retained for 30 days after completion.
tags:
- BPA Requests
parameters:
- name: request_id
in: path
required: true
description: Unique identifier of the BPA request.
schema:
type: string
example: bd9572c6-1b76-43a0-aa1c-3157a63cc89d
responses:
'200':
description: BPA request status returned.
content:
application/json:
schema:
$ref: '#/components/schemas/BPARequestStatus'
examples:
GetBparequestStatus200Example:
summary: Default getBPARequestStatus 200 response
x-microcks-default: true
value:
request_id: f629a7fb-33c3-4361-a3f4-c438e2f4f747
serial_number: 94C0577F8429
status: processing
report_id: '336271'
error_message: example-error_message
submitted_at: '2025-11-24T06:05:16Z'
completed_at: '2024-08-27T07:28:12Z'
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
GetBparequestStatus401Example:
summary: Default getBPARequestStatus 401 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
GetBparequestStatus403Example:
summary: Default getBPARequestStatus 403 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'404':
description: BPA request not found or expired.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
GetBparequestStatus404Example:
summary: Default getBPARequestStatus 404 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
GetBparequestStatus500Example:
summary: Default getBPARequestStatus 500 response
x-microcks-default: true
value:
error: example-error
message: Violation alert configured endpoint policy policy policy.
request_id: e0526af9-36bf-48c4-80c9-db1fb17c933f
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
schemas:
BPARequest:
type: object
required:
- serial_number
- version
properties:
serial_number:
type: string
description: Device serial number of the NGFW to assess.
example: 4B89BF130877
version:
type: string
description: PAN-OS software version running on the device (e.g., 11.1.2).
pattern: ^\d+\.\d+(\.\d+)?(-h\d+)?$
example: 9.6.8
device_info:
type: object
description: Optional supplementary device information.
properties:
hostname:
type: string
description: Device hostname.
example: host-d228
model:
type: string
description: Device model (e.g., PA-5450, PA-440).
example: VM-300
deployment_type:
type: string
enum:
- physical
- vm
- container
description: Device deployment type.
example: vm
example:
hostname: host-f367
model: VM-300
deployment_type: vm
BPARequestStatus:
type: object
properties:
request_id:
type: string
description: Unique identifier of the BPA request.
example: f629a7fb-33c3-4361-a3f4-c438e2f4f747
serial_number:
type: string
description: Device serial number for which the assessment was submitted.
example: 94C0577F8429
status:
type: string
enum:
- pending
- processing
- completed
- failed
description: Current processing status of the request.
example: processing
report_id:
type: string
description: Report identifier available when status is completed. Use with GET /reports/{report_id} to retrieve the full report.
example: '336271'
error_message:
type: string
description: Error description when status is failed.
example: example-error_message
submitted_at:
type: string
format: date-time
description: Timestamp when the request was submitted.
example: '2025-11-24T06:05:16Z'
completed_at:
type: string
format: date-time
description: Timestamp when processing completed.
example: '2024-08-27T07:28:12Z'
ErrorResponse:
type: object
properties:
error:
type: string
description: Error code identifying the error type.
example: example-error
message:
type: string
description: Human-readable description of the error.
example: Violation alert configured endpoint policy policy policy.
request_id:
type: string
description: Request identifier for support correlation.
example: e0526af9-36bf-48c4-80c9-db1fb17c933f
securitySchemes:
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.