Palo Alto Networks Firewalls API

openapi: 3.2.0
info:
  title: Palo Alto Networks Firewalls API
  version: '1.0'
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
  description: 'Operations tagged Firewalls across 2 of this provider''s published API definitions: palo-alto-cloud-ngfw-api-openapi-original.yml, palo-alto-networks-firewalls-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
  description: Cloud NGFW for AWS regional API endpoint.
  variables:
    region:
      description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
      default: us-east-1
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: Firewalls
  description: Cloud NGFW firewall instance management.
paths:
  /config/ngfirewalls:
    get:
      operationId: listFirewalls
      summary: Palo Alto Networks List Cloud NGFW Firewalls
      description: Returns a paginated list of all Cloud NGFW firewall instances in the AWS account. Each entry includes configuration, associated rule stack, VPC attachment, and operational status.
      tags:
      - Firewalls
      parameters:
      - name: maxresults
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      - name: nexttoken
        in: query
        schema:
          type: string
        example: example-nexttoken
      - name: vpcid
        in: query
        description: Filter firewalls by AWS VPC ID.
        schema:
          type: string
        example: '161612'
      responses:
        '200':
          description: Firewalls returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      Firewalls:
                        type: array
                        items:
                          $ref: '#/components/schemas/FirewallSummary'
                      NextToken:
                        type: string
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListFirewalls200Example:
                  summary: Default listFirewalls 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      Firewalls:
                      - FirewallName: Production Gateway 93
                        VpcId: '780399'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        Status: running
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    post:
      operationId: createFirewall
      summary: Palo Alto Networks Create Cloud NGFW Firewall
      description: Creates a new Cloud NGFW firewall instance in the specified VPC. Specify the associated rule stack, VPC and subnet mappings for endpoint creation, and optional logging configuration.
      tags:
      - Firewalls
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirewallRequest'
            examples:
              CreateFirewallRequestExample:
                summary: Default createFirewall request
                x-microcks-default: true
                value:
                  FirewallName: Production Sensor 15
                  FirewallEntry:
                    Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
                    VpcId: '911913'
                    AssociatedRuleStack: example-AssociatedRuleStack
                    SubnetMappings:
                    - SubnetId: '671001'
                    - SubnetId: '304867'
                    Tags:
                    - Key: example-Key
                      Value: example-Value
      responses:
        '200':
          description: Firewall created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateFirewall200Example:
                  summary: Default createFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    servers:
    - url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
      description: Cloud NGFW for AWS regional API endpoint.
      variables:
        region:
          description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
          default: us-east-1
  /config/ngfirewalls/{firewall}:
    get:
      operationId: getFirewall
      summary: Palo Alto Networks Get Cloud NGFW Firewall
      description: Returns the configuration and status of a specific Cloud NGFW firewall instance.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      responses:
        '200':
          description: Firewall returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                GetFirewall200Example:
                  summary: Default getFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    put:
      operationId: updateFirewall
      summary: Palo Alto Networks Update Cloud NGFW Firewall
      description: Updates the configuration of an existing Cloud NGFW firewall instance, such as changing the associated rule stack or updating subnet mappings.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirewallRequest'
            examples:
              UpdateFirewallRequestExample:
                summary: Default updateFirewall request
                x-microcks-default: true
                value:
                  FirewallName: Production Sensor 15
                  FirewallEntry:
                    Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
                    VpcId: '911913'
                    AssociatedRuleStack: example-AssociatedRuleStack
                    SubnetMappings:
                    - SubnetId: '671001'
                    - SubnetId: '304867'
                    Tags:
                    - Key: example-Key
                      Value: example-Value
      responses:
        '200':
          description: Firewall updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                UpdateFirewall200Example:
                  summary: Default updateFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    delete:
      operationId: deleteFirewall
      summary: Palo Alto Networks Delete Cloud NGFW Firewall
      description: Deletes a Cloud NGFW firewall instance. This disassociates the firewall from the VPC and removes all associated endpoints. The firewall must be in a PROVISIONING or ACTIVE state to be deleted.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      responses:
        '200':
          description: Firewall deletion initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                DeleteFirewall200Example:
                  summary: Default deleteFirewall 200 response
                  x-microcks-default: true
                  value:
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    servers:
    - url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
      description: Cloud NGFW for AWS regional API endpoint.
      variables:
        region:
          description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
          default: us-east-1
components:
  responses:
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid AWS credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or cannot be modified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    FirewallSummary:
      type: object
      properties:
        FirewallName:
          type: string
          example: Production Gateway 93
        VpcId:
          type: string
          example: '780399'
        AssociatedRuleStack:
          type: string
          example: example-AssociatedRuleStack
        Status:
          type: string
          example: running
    Firewall:
      type: object
      description: A Cloud NGFW firewall instance deployed in an AWS VPC.
      properties:
        FirewallName:
          type: string
          example: Corporate Policy 70
        FirewallEntry:
          type: object
          properties:
            Description:
              type: string
              example: Malware endpoint incident policy endpoint on applied rule applied.
            VpcId:
              type: string
              description: AWS VPC ID where the firewall is deployed.
              example: '886305'
            AssociatedRuleStack:
              type: string
              description: Name of the rule stack associated with this firewall.
              example: example-AssociatedRuleStack
            SubnetMappings:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    description: AWS subnet ID for the firewall endpoint.
                    example: '124164'
                  AvailabilityZone:
                    type: string
                    example: untrust
              example:
              - SubnetId: '297621'
                AvailabilityZone: dmz
              - SubnetId: '781667'
                AvailabilityZone: untrust
            Tags:
              type: array
              items:
                type: object
                properties:
                  Key:
                    type: string
                    example: example-Key
                  Value:
                    type: string
                    example: example-Value
              example:
              - Key: example-Key
                Value: example-Value
              - Key: example-Key
                Value: example-Value
          example:
            Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
            VpcId: '325753'
            AssociatedRuleStack: example-AssociatedRuleStack
            SubnetMappings:
            - SubnetId: '207407'
              AvailabilityZone: untrust
            Tags:
            - Key: example-Key
              Value: example-Value
        FirewallStatus:
          type: object
          properties:
            FirewallStatus:
              type: string
              enum:
              - PROVISIONING
              - ACTIVE
              - DELETING
              - FAILED
              example: FAILED
            Attachments:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    example: '513355'
                  EndpointId:
                    type: string
                    example: '268654'
                  Status:
                    type: string
                    example: active
              example:
              - SubnetId: '690238'
                EndpointId: '699787'
                Status: active
              - SubnetId: '994368'
                EndpointId: '479951'
                Status: running
          example:
            FirewallStatus: DELETING
            Attachments:
            - SubnetId: '241296'
              EndpointId: '635794'
              Status: enabled
            - SubnetId: '713413'
              EndpointId: '622390'
              Status: active
    ErrorResponse:
      type: object
      properties:
        ResponseStatus:
          type: object
          properties:
            ErrorCode:
              type: integer
              example: 869
            Reason:
              type: string
              example: Blocked investigation activity firewall activity malware network on applied.
          example:
            ErrorCode: 719
            Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
    ResponseStatus:
      type: object
      description: Standard API response status envelope included in all responses.
      properties:
        ErrorCode:
          type: integer
          description: Error code. 0 indicates success.
          example: 0
        Reason:
          type: string
          description: Human-readable status message.
          example: ''
    FirewallRequest:
      type: object
      required:
      - FirewallName
      - FirewallEntry
      properties:
        FirewallName:
          type: string
          example: Production Sensor 15
        FirewallEntry:
          type: object
          required:
          - VpcId
          - AssociatedRuleStack
          - SubnetMappings
          properties:
            Description:
              type: string
              example: Activity incident alert configured firewall suspicious policy.
            VpcId:
              type: string
              example: '226288'
            AssociatedRuleStack:
              type: string
              example: example-AssociatedRuleStack
            SubnetMappings:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    example: '436036'
              example:
              - SubnetId: '355983'
            Tags:
              type: array
              items:
                type: object
                properties:
                  Key:
                    type: string
                    example: example-Key
                  Value:
                    type: string
                    example: example-Value
              example:
              - Key: example-Key
                Value: example-Value
              - Key: example-Key
                Value: example-Value
          example:
            Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
            VpcId: '911913'
            AssociatedRuleStack: example-AssociatedRuleStack
            SubnetMappings:
            - SubnetId: '671001'
            - SubnetId: '304867'
            Tags:
            - Key: example-Key
              Value: example-Value
  parameters:
    firewall:
      name: firewall
      in: path
      required: true
      description: Name of the Cloud NGFW firewall instance.
      schema:
        type: string
  securitySchemes:
    awsSigV4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4 (SigV4) signed request. Use an AWS IAM role or user with CloudNGFW IAM permissions. Sign requests using the service name cloudngfw and the target AWS region. Include x-amz-date and x-amz-security-token headers as required.
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-cloud-ngfw-api-openapi-original.yml
- palo-alto-networks-firewalls-api-openapi.yml