Palo Alto Networks Images API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Images API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Images
  description: Container image vulnerability and compliance scan data.
paths:
  /images:
    get:
      operationId: getImages
      summary: Palo Alto Networks List Image Scan Results
      description: Returns vulnerability and compliance scan results for all container images known to Prisma Cloud Compute. Results include images from deployed containers on hosts with Defenders and from registry scans. Supports filtering by search term, cluster, and collection.
      tags:
      - Images
      parameters:
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of records to return.
        schema:
          type: integer
          default: 50
        example: 50
      - name: search
        in: query
        description: Search term to filter images by repository name or tag.
        schema:
          type: string
        example: example-search
      - name: sort
        in: query
        description: Field to sort results by.
        schema:
          type: string
          enum:
          - vulnerabilities
          - compliance
          - scanTime
        example: compliance
      - name: reverse
        in: query
        description: Sort in reverse order.
        schema:
          type: boolean
          default: false
        example: false
      - name: collections
        in: query
        description: Filter by collection name.
        schema:
          type: string
        example: example-collections
      - name: clusters
        in: query
        description: Filter by cluster name.
        schema:
          type: string
        example: example-clusters
      - name: compact
        in: query
        description: Return compact results without full vulnerability details.
        schema:
          type: boolean
          default: false
        example: false
      responses:
        '200':
          description: Image scan results returned successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Image'
              examples:
                GetImages200Example:
                  summary: Default getImages 200 response
                  x-microcks-default: true
                  value:
                  - _id: '856694'
                    hostname: host-9c7b
                    scanTime: '2024-03-20T05:38:38Z'
                    repoTag:
                      registry: example-registry
                      repo: example-repo
                      tag: critical-asset
                    repoDigests:
                    - example-repoDigests_item
                    - example-repoDigests_item
                    osDistro: example-osDistro
                    osDistroVersion: 10.9.7
                    vulnerabilities:
                    - id: example-id
                      status: deferred
                      cvss: 12.51
                      severity: high
                      packageName: Corporate Firewall 45
                      packageVersion: 5.1.8
                      fixedVersion: 5.4.9
                      link: https://portal.test-corp.net/0da215
                      description: Configured applied endpoint threat network Security.
                      publishedDate: '2026-05-18T00:03:03Z'
                    - id: example-id
                      status: fixed in
                      cvss: 68.07
                      severity: low
                      packageName: Primary Policy 76
                      packageVersion: 8.5.1
                      fixedVersion: 6.7.4
                      link: https://vpn.example.com/3f4797
                      description: Incident network violation rule incident blocked activity applied endpoint policy incident.
                      publishedDate: '2024-05-26T07:45:57Z'
                    vulnerabilitiesCount: 554
                    vulnerabilityDistribution:
                      critical: 813
                      high: 64
                      medium: 396
                      low: 795
                    complianceIssues:
                    - id: 915
                      title: Branch Policy 90
                      severity: medium
                      cause: example-cause
                      description: Network applied activity rule applied suspicious activity suspicious firewall.
                    - id: 165
                      title: Primary Gateway 48
                      severity: medium
                      cause: example-cause
                      description: Malware malware configured suspicious threat suspicious network violation.
                    complianceIssuesCount: 705
                    clusters:
                    - example-clusters_item
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /images/download:
    get:
      operationId: downloadImageScanResults
      summary: Palo Alto Networks Download Image Scan Results
      description: Downloads image scan results as a CSV file. Supports the same filtering parameters as the GET /images endpoint. Useful for bulk export and integration with external vulnerability management systems.
      tags:
      - Images
      parameters:
      - name: search
        in: query
        description: Search term to filter images by repository name or tag.
        schema:
          type: string
        example: example-search
      - name: collections
        in: query
        description: Filter by collection name.
        schema:
          type: string
        example: example-collections
      - name: clusters
        in: query
        description: Filter by cluster name.
        schema:
          type: string
        example: example-clusters
      responses:
        '200':
          description: Image scan results CSV file returned.
          content:
            text/csv:
              schema:
                type: string
                format: binary
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or expired authentication credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Vulnerability:
      type: object
      properties:
        id:
          type: string
          description: CVE identifier (e.g., CVE-2024-1234).
          example: example-id
        status:
          type: string
          enum:
          - fixed in
          - needed
          - will not fix
          - deferred
          description: Fix availability status.
          example: deferred
        cvss:
          type: number
          format: float
          description: CVSS v3 base score.
          example: 13.89
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          description: Severity level derived from CVSS score.
          example: critical
        packageName:
          type: string
          description: Name of the affected package.
          example: Branch Policy 65
        packageVersion:
          type: string
          description: Installed version of the affected package.
          example: 2.9.1
        fixedVersion:
          type: string
          description: Version that contains the fix, if available.
          example: 9.6.0
        link:
          type: string
          description: URL to the CVE advisory or details page.
          example: https://api.example.com/9c88b4
        description:
          type: string
          description: Brief description of the vulnerability.
          example: Monitoring blocked suspicious activity malware traffic Security policy rule configured.
        publishedDate:
          type: string
          format: date-time
          description: Date the vulnerability was publicly disclosed.
          example: '2026-07-04T20:08:13Z'
    Image:
      type: object
      properties:
        _id:
          type: string
          description: Unique image identifier composed of registry, repository, and tag.
          example: '856694'
        hostname:
          type: string
          description: Hostname of the machine where the image was scanned.
          example: host-9c7b
        scanTime:
          type: string
          format: date-time
          description: Timestamp of the most recent scan.
          example: '2024-03-20T05:38:38Z'
        repoTag:
          type: object
          description: Repository and tag information for the image.
          properties:
            registry:
              type: string
              description: Container registry URL.
              example: example-registry
            repo:
              type: string
              description: Repository name.
              example: example-repo
            tag:
              type: string
              description: Image tag.
              example: pci-scope
          example:
            registry: example-registry
            repo: example-repo
            tag: critical-asset
        repoDigests:
          type: array
          description: Content-addressable image digests.
          items:
            type: string
          example:
          - example-repoDigests_item
          - example-repoDigests_item
        osDistro:
          type: string
          description: Operating system distribution of the image.
          example: example-osDistro
        osDistroVersion:
          type: string
          description: Operating system distribution version.
          example: 10.9.7
        vulnerabilities:
          type: array
          description: Vulnerabilities discovered in the image.
          items:
            $ref: '#/components/schemas/Vulnerability'
          example:
          - id: example-id
            status: deferred
            cvss: 12.51
            severity: high
            packageName: Corporate Firewall 45
            packageVersion: 5.1.8
            fixedVersion: 5.4.9
            link: https://portal.test-corp.net/0da215
            description: Configured applied endpoint threat network Security.
            publishedDate: '2026-05-18T00:03:03Z'
          - id: example-id
            status: fixed in
            cvss: 68.07
            severity: low
            packageName: Primary Policy 76
            packageVersion: 8.5.1
            fixedVersion: 6.7.4
            link: https://vpn.example.com/3f4797
            description: Incident network violation rule incident blocked activity applied endpoint policy incident.
            publishedDate: '2024-05-26T07:45:57Z'
        vulnerabilitiesCount:
          type: integer
          description: Total number of vulnerabilities found.
          example: 554
        vulnerabilityDistribution:
          type: object
          description: Vulnerability count by severity level.
          properties:
            critical:
              type: integer
              example: 62
            high:
              type: integer
              example: 107
            medium:
              type: integer
              example: 509
            low:
              type: integer
              example: 687
          example:
            critical: 813
            high: 64
            medium: 396
            low: 795
        complianceIssues:
          type: array
          description: Compliance check failures for the image.
          items:
            $ref: '#/components/schemas/ComplianceIssue'
          example:
          - id: 915
            title: Branch Policy 90
            severity: medium
            cause: example-cause
            description: Network applied activity rule applied suspicious activity suspicious firewall.
          - id: 165
            title: Primary Gateway 48
            severity: medium
            cause: example-cause
            description: Malware malware configured suspicious threat suspicious network violation.
        complianceIssuesCount:
          type: integer
          description: Total number of compliance issues found.
          example: 705
        clusters:
          type: array
          description: Kubernetes clusters where this image is deployed.
          items:
            type: string
          example:
          - example-clusters_item
    ComplianceIssue:
      type: object
      properties:
        id:
          type: integer
          description: Compliance check ID.
          example: 668
        title:
          type: string
          description: Title of the compliance check.
          example: Primary Firewall 38
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          description: Severity of the compliance issue.
          example: high
        cause:
          type: string
          description: Explanation of why the resource failed the check.
          example: example-cause
        description:
          type: string
          description: Detailed description of the compliance requirement.
          example: Detected on policy monitoring detected alert.
    ErrorResponse:
      type: object
      properties:
        err:
          type: string
          description: Error message.
          example: example-err
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.