Palo Alto Networks Log Forwarding Profiles API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Log Forwarding Profiles API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Log Forwarding Profiles
  description: Log forwarding profile management.
paths:
  /log-forwarding-profiles:
    get:
      operationId: listLogForwardingProfiles
      summary: Palo Alto Networks List Log Forwarding Profiles
      description: Returns the list of log forwarding profiles configured for the tenant. Each profile can have multiple destinations of different types and defines which log types are forwarded.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of profiles to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Log forwarding profiles returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                ListLogForwardingProfiles200Example:
                  summary: Default listLogForwardingProfiles 200 response
                  x-microcks-default: true
                  value:
                    total: 43
                    offset: 34
                    limit: 885
                    items:
                    - profile_id: '960762'
                      name: Branch Sensor 06
                      description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                      log_types:
                      - config
                      enabled: false
                      destination_count: 931
                      created_at: '2026-06-18T01:07:29Z'
                      updated_at: '2026-10-01T15:28:36Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListLogForwardingProfiles401Example:
                  summary: Default listLogForwardingProfiles 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListLogForwardingProfiles403Example:
                  summary: Default listLogForwardingProfiles 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListLogForwardingProfiles500Example:
                  summary: Default listLogForwardingProfiles 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createLogForwardingProfile
      summary: Palo Alto Networks Create Log Forwarding Profile
      description: Creates a new log forwarding profile. After creating a profile, add destinations using the destination-specific endpoints.
      tags:
      - Log Forwarding Profiles
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogForwardingProfileRequest'
            examples:
              CreateLogForwardingProfileRequestExample:
                summary: Default createLogForwardingProfile request
                x-microcks-default: true
                value:
                  name: Staging Gateway 28
                  description: Applied detected endpoint blocked malware detected suspicious Security on investigation configured endpoint.
                  log_types:
                  - auth
                  enabled: true
      responses:
        '201':
          description: Log forwarding profile created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                CreateLogForwardingProfile201Example:
                  summary: Default createLogForwardingProfile 201 response
                  x-microcks-default: true
                  value:
                    profile_id: '960762'
                    name: Branch Sensor 06
                    description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                    log_types:
                    - config
                    enabled: false
                    destination_count: 931
                    created_at: '2026-06-18T01:07:29Z'
                    updated_at: '2026-10-01T15:28:36Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile400Example:
                  summary: Default createLogForwardingProfile 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile401Example:
                  summary: Default createLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile403Example:
                  summary: Default createLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile500Example:
                  summary: Default createLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /log-forwarding-profiles/{profile_id}:
    get:
      operationId: getLogForwardingProfile
      summary: Palo Alto Networks Get Log Forwarding Profile
      description: Returns full details for a specific log forwarding profile.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '275381'
      responses:
        '200':
          description: Log forwarding profile details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                GetLogForwardingProfile200Example:
                  summary: Default getLogForwardingProfile 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '960762'
                    name: Branch Sensor 06
                    description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                    log_types:
                    - config
                    enabled: false
                    destination_count: 931
                    created_at: '2026-06-18T01:07:29Z'
                    updated_at: '2026-10-01T15:28:36Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile401Example:
                  summary: Default getLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile403Example:
                  summary: Default getLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile404Example:
                  summary: Default getLogForwardingProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile500Example:
                  summary: Default getLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateLogForwardingProfile
      summary: Palo Alto Networks Update Log Forwarding Profile
      description: Updates an existing log forwarding profile configuration.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile to update.
        schema:
          type: string
        example: '711652'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogForwardingProfileRequest'
            examples:
              UpdateLogForwardingProfileRequestExample:
                summary: Default updateLogForwardingProfile request
                x-microcks-default: true
                value:
                  name: Staging Gateway 28
                  description: Applied detected endpoint blocked malware detected suspicious Security on investigation configured endpoint.
                  log_types:
                  - auth
                  enabled: true
      responses:
        '200':
          description: Log forwarding profile updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                UpdateLogForwardingProfile200Example:
                  summary: Default updateLogForwardingProfile 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '960762'
                    name: Branch Sensor 06
                    description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                    log_types:
                    - config
                    enabled: false
                    destination_count: 931
                    created_at: '2026-06-18T01:07:29Z'
                    updated_at: '2026-10-01T15:28:36Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile400Example:
                  summary: Default updateLogForwardingProfile 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile401Example:
                  summary: Default updateLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile403Example:
                  summary: Default updateLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile404Example:
                  summary: Default updateLogForwardingProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile500Example:
                  summary: Default updateLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteLogForwardingProfile
      summary: Palo Alto Networks Delete Log Forwarding Profile
      description: Deletes a log forwarding profile and all associated destinations.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile to delete.
        schema:
          type: string
        example: '254293'
      responses:
        '204':
          description: Log forwarding profile deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile401Example:
                  summary: Default deleteLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile403Example:
                  summary: Default deleteLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile404Example:
                  summary: Default deleteLogForwardingProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile500Example:
                  summary: Default deleteLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /log-forwarding-profiles/{profile_id}/status:
    get:
      operationId: getLogForwardingStatus
      summary: Palo Alto Networks Get Log Forwarding Profile Status
      description: Returns the current operational status of a log forwarding profile including per-destination connectivity health, last successful delivery timestamps, and error counts.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '829608'
      responses:
        '200':
          description: Log forwarding profile status returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForwardingStatus'
              examples:
                GetLogForwardingStatus200Example:
                  summary: Default getLogForwardingStatus 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '626174'
                    overall_status: degraded
                    destinations:
                    - destination_id: '791939'
                      destination_type: https
                      status: disabled
                      last_successful_delivery: '2024-07-16T07:19:33Z'
                      error_count_24h: 108
                      last_error: example-last_error
                    - destination_id: '298167'
                      destination_type: email
                      status: error
                      last_successful_delivery: '2024-09-15T04:55:46Z'
                      error_count_24h: 788
                      last_error: example-last_error
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus401Example:
                  summary: Default getLogForwardingStatus 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus403Example:
                  summary: Default getLogForwardingStatus 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus404Example:
                  summary: Default getLogForwardingStatus 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus500Example:
                  summary: Default getLogForwardingStatus 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    LogForwardingProfile:
      type: object
      properties:
        profile_id:
          type: string
          description: Unique identifier of the profile.
          example: '960762'
        name:
          type: string
          description: Display name of the profile.
          example: Branch Sensor 06
        description:
          type: string
          description: Description of the profile's purpose.
          example: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
        log_types:
          type: array
          items:
            type: string
            enum:
            - traffic
            - threat
            - url
            - wildfire
            - auth
            - decryption
            - globalprotect
            - system
            - config
          description: Log types included in this forwarding profile.
          example:
          - config
        enabled:
          type: boolean
          description: Whether this profile is actively forwarding logs.
          example: false
        destination_count:
          type: integer
          description: Total number of configured destinations.
          example: 931
        created_at:
          type: string
          format: date-time
          example: '2026-06-18T01:07:29Z'
        updated_at:
          type: string
          format: date-time
          example: '2026-10-01T15:28:36Z'
    LogForwardingProfileRequest:
      type: object
      required:
      - name
      - log_types
      properties:
        name:
          type: string
          description: Display name for the profile.
          example: Staging Gateway 28
        description:
          type: string
          description: Optional description.
          example: Applied detected endpoint blocked malware detected suspicious Security on investigation configured endpoint.
        log_types:
          type: array
          items:
            type: string
            enum:
            - traffic
            - threat
            - url
            - wildfire
            - auth
            - decryption
            - globalprotect
            - system
            - config
          description: Log types to include in forwarding.
          example:
          - auth
        enabled:
          type: boolean
          default: true
          example: true
    ForwardingStatus:
      type: object
      properties:
        profile_id:
          type: string
          description: Log forwarding profile identifier.
          example: '626174'
        overall_status:
          type: string
          enum:
          - healthy
          - degraded
          - error
          description: Overall health status of the forwarding profile.
          example: degraded
        destinations:
          type: array
          description: Per-destination status details.
          items:
            type: object
            properties:
              destination_id:
                type: string
                example: '745564'
              destination_type:
                type: string
                enum:
                - syslog
                - https
                - email
                example: https
              status:
                type: string
                enum:
                - healthy
                - error
                - disabled
                example: healthy
              last_successful_delivery:
                type: string
                format: date-time
                example: '2026-08-09T23:11:14Z'
              error_count_24h:
                type: integer
                example: 677
              last_error:
                type: string
                example: example-last_error
          example:
          - destination_id: '791939'
            destination_type: https
            status: disabled
            last_successful_delivery: '2024-07-16T07:19:33Z'
            error_count_24h: 108
            last_error: example-last_error
          - destination_id: '298167'
            destination_type: email
            status: error
            last_successful_delivery: '2024-09-15T04:55:46Z'
            error_count_24h: 788
            last_error: example-last_error
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 59fcc104-7100-494b-b0c4-09f9dcc477d9
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.