Palo Alto Networks Integrations API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Integrations API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Integrations
  description: Integration and instance management.
paths:
  /integration/search:
    get:
      operationId: searchIntegrations
      summary: Palo Alto Networks Search Integrations
      description: Returns a list of available integration packs installed in the Cortex XSOAR instance. Integrations provide connectivity to third-party security tools and platforms.
      tags:
      - Integrations
      parameters:
      - name: query
        in: query
        description: Search query to filter integrations by name or category.
        schema:
          type: string
        example: example-query
      - name: page
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: size
        in: query
        schema:
          type: integer
          default: 50
        example: 50
      responses:
        '200':
          description: Integrations returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  configurations:
                    type: array
                    items:
                      $ref: '#/components/schemas/Integration'
                  total:
                    type: integer
              examples:
                SearchIntegrations200Example:
                  summary: Default searchIntegrations 200 response
                  x-microcks-default: true
                  value:
                    configurations:
                    - id: example-id
                      name: Corporate Policy 44
                      display: example-display
                      category: standard
                      description: Malware malware threat suspicious alert alert violation incident activity detected policy rule.
                      version: 338
                      fromVersion: 10.3.1
                      deprecated: false
                      beta: true
                    - id: example-id
                      name: Corporate Policy 44
                      display: example-display
                      category: standard
                      description: Malware malware threat suspicious alert alert violation incident activity detected policy rule.
                      version: 338
                      fromVersion: 10.3.1
                      deprecated: false
                      beta: true
                    total: 906
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /settings/integration/search:
    post:
      operationId: searchIntegrationInstances
      summary: Palo Alto Networks Search Integration Instances
      description: Returns a list of configured integration instances. Each instance represents a configured connection to a specific tool using a particular integration pack. Supports filtering by integration name and enabled status.
      tags:
      - Integrations
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                query:
                  type: string
                  description: Search query to filter instances by name or brand.
                page:
                  type: integer
                  default: 0
                size:
                  type: integer
                  default: 50
            examples:
              SearchIntegrationInstancesRequestExample:
                summary: Default searchIntegrationInstances request
                x-microcks-default: true
                value:
                  query: example-query
                  page: 0
                  size: 50
      responses:
        '200':
          description: Integration instances returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  instances:
                    type: array
                    items:
                      $ref: '#/components/schemas/IntegrationInstance'
                  total:
                    type: integer
              examples:
                SearchIntegrationInstances200Example:
                  summary: Default searchIntegrationInstances 200 response
                  x-microcks-default: true
                  value:
                    instances:
                    - id: example-id
                      name: Staging Firewall 25
                      brand: example-brand
                      enabled: 'false'
                      isIntegrationScript: true
                      incomingMapperId: '599642'
                      mappingId: '597859'
                      configuration: &id001 {}
                    - id: example-id
                      name: Staging Firewall 25
                      brand: example-brand
                      enabled: 'false'
                      isIntegrationScript: true
                      incomingMapperId: '599642'
                      mappingId: '597859'
                      configuration: *id001
                    total: 629
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/jira-integrations:
    get:
      operationId: listJiraIntegrations
      summary: Palo Alto Networks List Jira Integrations
      description: Returns the configured Jira integrations for automatically creating tickets when posture check failures are detected. Each integration specifies the Jira project, issue type, and mapping from check severity to ticket priority.
      tags:
      - Integrations
      responses:
        '200':
          description: Jira integrations returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/JiraIntegration'
              examples:
                ListJiraIntegrations200Example:
                  summary: Default listJiraIntegrations 200 response
                  x-microcks-default: true
                  value:
                    total: 286
                    items:
                    - id: example-id
                      name: Staging Agent 91
                      jira_url: https://portal.acme-systems.org/e51406
                      project_key: example-project_key
                      issue_type: custom
                      enabled: true
                      created_at: '2026-08-06T08:43:39Z'
                    - id: example-id
                      name: Staging Agent 91
                      jira_url: https://portal.acme-systems.org/e51406
                      project_key: example-project_key
                      issue_type: custom
                      enabled: true
                      created_at: '2026-08-06T08:43:39Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListJiraIntegrations401Example:
                  summary: Default listJiraIntegrations 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListJiraIntegrations403Example:
                  summary: Default listJiraIntegrations 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListJiraIntegrations500Example:
                  summary: Default listJiraIntegrations 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createJiraIntegration
      summary: Palo Alto Networks Create Jira Integration
      description: Creates a new Jira integration for automatic ticket creation when SSPM posture check failures are detected. Requires a valid Jira server URL, API token, and project configuration.
      tags:
      - Integrations
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JiraIntegrationRequest'
            examples:
              CreateJiraIntegrationRequestExample:
                summary: Default createJiraIntegration request
                x-microcks-default: true
                value:
                  name: Primary Sensor 29
                  jira_url: https://mail.example.com/95ba91
                  project_key: example-project_key
                  issue_type: Bug
                  api_token: example-api_token
                  email: security-ops@example.com
                  severity_mapping: {}
      responses:
        '201':
          description: Jira integration created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JiraIntegration'
              examples:
                CreateJiraIntegration201Example:
                  summary: Default createJiraIntegration 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Staging Agent 91
                    jira_url: https://portal.acme-systems.org/e51406
                    project_key: example-project_key
                    issue_type: custom
                    enabled: true
                    created_at: '2026-08-06T08:43:39Z'
        '400':
          description: Invalid request body or Jira configuration.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                CreateJiraIntegration400Example:
                  summary: Default createJiraIntegration 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                CreateJiraIntegration401Example:
                  summary: Default createJiraIntegration 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                CreateJiraIntegration403Example:
                  summary: Default createJiraIntegration 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                CreateJiraIntegration500Example:
                  summary: Default createJiraIntegration 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    JiraIntegration:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the Jira integration.
          example: example-id
        name:
          type: string
          description: Display name for the integration.
          example: Staging Agent 91
        jira_url:
          type: string
          format: uri
          description: Base URL of the Jira server or cloud instance.
          example: https://portal.acme-systems.org/e51406
        project_key:
          type: string
          description: Jira project key where tickets are created.
          example: example-project_key
        issue_type:
          type: string
          description: Jira issue type for created tickets (e.g., Bug, Task).
          example: custom
        enabled:
          type: boolean
          description: Whether the integration is actively creating tickets.
          example: true
        created_at:
          type: string
          format: date-time
          example: '2026-08-06T08:43:39Z'
    Integration:
      type: object
      description: A Cortex XSOAR integration pack providing connectivity to a third-party tool.
      properties:
        id:
          type: string
          example: example-id
        name:
          type: string
          example: Corporate Policy 44
        display:
          type: string
          description: Human-readable display name.
          example: example-display
        category:
          type: string
          description: Integration category (e.g., Endpoint, Firewall, SIEM).
          example: standard
        description:
          type: string
          example: Malware malware threat suspicious alert alert violation incident activity detected policy rule.
        version:
          type: integer
          example: 338
        fromVersion:
          type: string
          example: 10.3.1
        deprecated:
          type: boolean
          example: false
        beta:
          type: boolean
          example: true
    JiraIntegrationRequest:
      type: object
      required:
      - name
      - jira_url
      - project_key
      - api_token
      - email
      properties:
        name:
          type: string
          description: Display name for this integration.
          example: Primary Sensor 29
        jira_url:
          type: string
          format: uri
          description: Base URL of the Jira server or cloud instance.
          example: https://mail.example.com/95ba91
        project_key:
          type: string
          description: Jira project key where tickets will be created.
          example: example-project_key
        issue_type:
          type: string
          description: Jira issue type (e.g., Bug, Task, Story).
          default: Bug
          example: Bug
        api_token:
          type: string
          description: Jira API token for authentication.
          writeOnly: true
          example: example-api_token
        email:
          type: string
          format: email
          description: Email address associated with the Jira API token.
          example: security-ops@example.com
        severity_mapping:
          type: object
          description: Mapping from SSPM severity levels to Jira priorities.
          additionalProperties:
            type: string
          example: {}
    IntegrationInstance:
      type: object
      description: A configured instance of an integration in Cortex XSOAR.
      properties:
        id:
          type: string
          example: example-id
        name:
          type: string
          description: Unique name of this instance.
          example: Staging Firewall 25
        brand:
          type: string
          description: Integration brand name.
          example: example-brand
        enabled:
          type: string
          enum:
          - 'true'
          - 'false'
          example: 'false'
        isIntegrationScript:
          type: boolean
          example: true
        incomingMapperId:
          type: string
          example: '599642'
        mappingId:
          type: string
          example: '597859'
        configuration:
          type: object
          description: Integration configuration parameters.
          example: {}
    ErrorResponse:
      type: object
      properties:
        id:
          type: string
          example: example-id
        status:
          type: integer
          example: 19
        title:
          type: string
          example: Corporate Gateway 74
        detail:
          type: string
          example: example-detail
        error:
          type: string
          example: example-error
    ErrorResponse_2:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Malware violation rule blocked detected endpoint policy detected.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
  responses:
    Unauthorized:
      description: Missing or invalid API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.