Palo Alto Networks FQDN Lists API

openapi: 3.2.0
info:
  title: Palo Alto Networks FQDN Lists API
  version: '1.0'
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
  description: 'Operations tagged FQDNLists across 2 of this provider''s published API definitions: palo-alto-cloud-ngfw-api-openapi-original.yml, palo-alto-networks-fqdnlists-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
  description: Cloud NGFW for AWS regional API endpoint.
  variables:
    region:
      description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
      default: us-east-1
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: FQDNLists
  description: FQDN list management for use in security rule destination criteria.
paths:
  /config/rulestacks/{rulestack}/fqdnlists:
    get:
      operationId: listFqdnLists
      summary: Palo Alto Networks List FQDN Lists
      description: Returns all FQDN lists in the specified rule stack. FQDN lists contain domain name entries referenced in security rule destination criteria.
      tags:
      - FQDNLists
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - name: maxresults
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      - name: nexttoken
        in: query
        schema:
          type: string
        example: example-nexttoken
      responses:
        '200':
          description: FQDN lists returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      FqdnListCandidates:
                        type: array
                        items:
                          $ref: '#/components/schemas/FqdnListSummary'
                      NextToken:
                        type: string
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListFqdnLists200Example:
                  summary: Default listFqdnLists 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FqdnListCandidates:
                      - FqdnListName: Primary Firewall 80
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    post:
      operationId: createFqdnList
      summary: Palo Alto Networks Create FQDN List
      description: Creates a new FQDN list in the rule stack with a set of domain name entries.
      tags:
      - FQDNLists
      parameters:
      - $ref: '#/components/parameters/rulestack'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FqdnListRequest'
            examples:
              CreateFqdnListRequestExample:
                summary: Default createFqdnList request
                x-microcks-default: true
                value:
                  FqdnListName: Primary Agent 55
                  FqdnListEntry:
                    Description: Network rule endpoint traffic suspicious on configured suspicious policy violation detected.
                    FqdnList:
                    - example-FqdnList_item
                    - example-FqdnList_item
      responses:
        '200':
          description: FQDN list created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/FqdnList'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateFqdnList200Example:
                  summary: Default createFqdnList 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FqdnListName: Production Firewall 87
                      FqdnListEntry:
                        Description: Incident configured activity on configured detected alert investigation policy blocked incident.
                        FqdnList:
                        - example-FqdnList_item
                      UpdateToken: example-UpdateToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - awsSigV4: []
    servers:
    - url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
      description: Cloud NGFW for AWS regional API endpoint.
      variables:
        region:
          description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
          default: us-east-1
components:
  parameters:
    rulestack:
      name: rulestack
      in: path
      required: true
      description: Name of the rule stack.
      schema:
        type: string
  schemas:
    FqdnList:
      type: object
      description: An FQDN list containing domain name entries for use in security rule destination criteria.
      properties:
        FqdnListName:
          type: string
          example: Production Firewall 87
        FqdnListEntry:
          type: object
          properties:
            Description:
              type: string
              example: Suspicious incident incident network firewall alert applied traffic blocked firewall policy violation.
            FqdnList:
              type: array
              items:
                type: string
              description: Fully qualified domain names (e.g., example.com, *.example.com).
              example:
              - example-FqdnList_item
              - example-FqdnList_item
          example:
            Description: Incident configured activity on configured detected alert investigation policy blocked incident.
            FqdnList:
            - example-FqdnList_item
        UpdateToken:
          type: string
          example: example-UpdateToken
    FqdnListSummary:
      type: object
      properties:
        FqdnListName:
          type: string
          example: Primary Firewall 80
    ErrorResponse:
      type: object
      properties:
        ResponseStatus:
          type: object
          properties:
            ErrorCode:
              type: integer
              example: 869
            Reason:
              type: string
              example: Blocked investigation activity firewall activity malware network on applied.
          example:
            ErrorCode: 719
            Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
    ResponseStatus:
      type: object
      description: Standard API response status envelope included in all responses.
      properties:
        ErrorCode:
          type: integer
          description: Error code. 0 indicates success.
          example: 0
        Reason:
          type: string
          description: Human-readable status message.
          example: ''
    FqdnListRequest:
      type: object
      required:
      - FqdnListName
      - FqdnListEntry
      properties:
        FqdnListName:
          type: string
          example: Primary Agent 55
        FqdnListEntry:
          type: object
          required:
          - FqdnList
          properties:
            Description:
              type: string
              example: Suspicious violation threat network rule firewall network.
            FqdnList:
              type: array
              items:
                type: string
              example:
              - example-FqdnList_item
              - example-FqdnList_item
          example:
            Description: Network rule endpoint traffic suspicious on configured suspicious policy violation detected.
            FqdnList:
            - example-FqdnList_item
            - example-FqdnList_item
  responses:
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid AWS credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or cannot be modified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    awsSigV4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4 (SigV4) signed request. Use an AWS IAM role or user with CloudNGFW IAM permissions. Sign requests using the service name cloudngfw and the target AWS region. Include x-amz-date and x-amz-security-token headers as required.
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-cloud-ngfw-api-openapi-original.yml
- palo-alto-networks-fqdnlists-api-openapi.yml