Palo Alto Networks Log Forwarding Profiles API

openapi: 3.2.0
info:
  title: Palo Alto Networks Log Forwarding Profiles API
  version: '1.0'
  description: 'Operations tagged Log Forwarding Profiles across 3 of this provider''s published API definitions: palo-alto-networks-log-forwarding-profiles-api-openapi.yml, palo-alto-scm-config-cloudngfw-objects-objects-june-openapi.yaml, palo-alto-strata-logging-service-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
- url: https://api.strata.paloaltonetworks.com/config/objects/v1
  description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
  description: Legacy
- url: https://api.sase.paloaltonetworks.com/logging-service/v1
  description: Strata Logging Service API production server.
tags:
- name: Log Forwarding Profiles
  description: Log forwarding profile management.
paths:
  /log-forwarding-profiles:
    get:
      operationId: listLogForwardingProfiles
      summary: Palo Alto Networks List Log Forwarding Profiles
      description: Returns the list of log forwarding profiles configured for the tenant. Each profile can have multiple destinations of different types and defines which log types are forwarded.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of profiles to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Log forwarding profiles returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                ListLogForwardingProfiles200Example:
                  summary: Default listLogForwardingProfiles 200 response
                  x-microcks-default: true
                  value:
                    total: 43
                    offset: 34
                    limit: 885
                    items:
                    - profile_id: '960762'
                      name: Branch Sensor 06
                      description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                      log_types:
                      - config
                      enabled: false
                      destination_count: 931
                      created_at: '2026-06-18T01:07:29Z'
                      updated_at: '2026-10-01T15:28:36Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListLogForwardingProfiles401Example:
                  summary: Default listLogForwardingProfiles 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListLogForwardingProfiles403Example:
                  summary: Default listLogForwardingProfiles 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListLogForwardingProfiles500Example:
                  summary: Default listLogForwardingProfiles 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    post:
      operationId: createLogForwardingProfile
      summary: Palo Alto Networks Create Log Forwarding Profile
      description: Creates a new log forwarding profile. After creating a profile, add destinations using the destination-specific endpoints.
      tags:
      - Log Forwarding Profiles
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogForwardingProfileRequest'
            examples:
              CreateLogForwardingProfileRequestExample:
                summary: Default createLogForwardingProfile request
                x-microcks-default: true
                value:
                  name: Staging Gateway 28
                  description: Applied detected endpoint blocked malware detected suspicious Security on investigation configured endpoint.
                  log_types:
                  - auth
                  enabled: true
      responses:
        '201':
          description: Log forwarding profile created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                CreateLogForwardingProfile201Example:
                  summary: Default createLogForwardingProfile 201 response
                  x-microcks-default: true
                  value:
                    profile_id: '960762'
                    name: Branch Sensor 06
                    description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                    log_types:
                    - config
                    enabled: false
                    destination_count: 931
                    created_at: '2026-06-18T01:07:29Z'
                    updated_at: '2026-10-01T15:28:36Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile400Example:
                  summary: Default createLogForwardingProfile 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile401Example:
                  summary: Default createLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile403Example:
                  summary: Default createLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateLogForwardingProfile500Example:
                  summary: Default createLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /log-forwarding-profiles/{profile_id}:
    get:
      operationId: getLogForwardingProfile
      summary: Palo Alto Networks Get Log Forwarding Profile
      description: Returns full details for a specific log forwarding profile.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '275381'
      responses:
        '200':
          description: Log forwarding profile details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                GetLogForwardingProfile200Example:
                  summary: Default getLogForwardingProfile 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '960762'
                    name: Branch Sensor 06
                    description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                    log_types:
                    - config
                    enabled: false
                    destination_count: 931
                    created_at: '2026-06-18T01:07:29Z'
                    updated_at: '2026-10-01T15:28:36Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile401Example:
                  summary: Default getLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile403Example:
                  summary: Default getLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile404Example:
                  summary: Default getLogForwardingProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingProfile500Example:
                  summary: Default getLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    put:
      operationId: updateLogForwardingProfile
      summary: Palo Alto Networks Update Log Forwarding Profile
      description: Updates an existing log forwarding profile configuration.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile to update.
        schema:
          type: string
        example: '711652'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogForwardingProfileRequest'
            examples:
              UpdateLogForwardingProfileRequestExample:
                summary: Default updateLogForwardingProfile request
                x-microcks-default: true
                value:
                  name: Staging Gateway 28
                  description: Applied detected endpoint blocked malware detected suspicious Security on investigation configured endpoint.
                  log_types:
                  - auth
                  enabled: true
      responses:
        '200':
          description: Log forwarding profile updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwardingProfile'
              examples:
                UpdateLogForwardingProfile200Example:
                  summary: Default updateLogForwardingProfile 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '960762'
                    name: Branch Sensor 06
                    description: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
                    log_types:
                    - config
                    enabled: false
                    destination_count: 931
                    created_at: '2026-06-18T01:07:29Z'
                    updated_at: '2026-10-01T15:28:36Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile400Example:
                  summary: Default updateLogForwardingProfile 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile401Example:
                  summary: Default updateLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile403Example:
                  summary: Default updateLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile404Example:
                  summary: Default updateLogForwardingProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateLogForwardingProfile500Example:
                  summary: Default updateLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    delete:
      operationId: deleteLogForwardingProfile
      summary: Palo Alto Networks Delete Log Forwarding Profile
      description: Deletes a log forwarding profile and all associated destinations.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile to delete.
        schema:
          type: string
        example: '254293'
      responses:
        '204':
          description: Log forwarding profile deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile401Example:
                  summary: Default deleteLogForwardingProfile 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile403Example:
                  summary: Default deleteLogForwardingProfile 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile404Example:
                  summary: Default deleteLogForwardingProfile 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteLogForwardingProfile500Example:
                  summary: Default deleteLogForwardingProfile 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /log-forwarding-profiles/{profile_id}/status:
    get:
      operationId: getLogForwardingStatus
      summary: Palo Alto Networks Get Log Forwarding Profile Status
      description: Returns the current operational status of a log forwarding profile including per-destination connectivity health, last successful delivery timestamps, and error counts.
      tags:
      - Log Forwarding Profiles
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '829608'
      responses:
        '200':
          description: Log forwarding profile status returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForwardingStatus'
              examples:
                GetLogForwardingStatus200Example:
                  summary: Default getLogForwardingStatus 200 response
                  x-microcks-default: true
                  value:
                    profile_id: '626174'
                    overall_status: degraded
                    destinations:
                    - destination_id: '791939'
                      destination_type: https
                      status: disabled
                      last_successful_delivery: '2024-07-16T07:19:33Z'
                      error_count_24h: 108
                      last_error: example-last_error
                    - destination_id: '298167'
                      destination_type: email
                      status: error
                      last_successful_delivery: '2024-09-15T04:55:46Z'
                      error_count_24h: 788
                      last_error: example-last_error
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus401Example:
                  summary: Default getLogForwardingStatus 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus403Example:
                  summary: Default getLogForwardingStatus 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus404Example:
                  summary: Default getLogForwardingStatus 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetLogForwardingStatus500Example:
                  summary: Default getLogForwardingStatus 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /log-forwarding-profiles/{id}:
    get:
      tags:
      - Log Forwarding Profiles
      summary: Get a log forwarding profile
      description: Get an existing log forwarding profile.
      operationId: GetLogForwardingProfilesByID
      parameters:
      - $ref: '#/components/parameters/uuid'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/log-forwarding-profiles'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        default:
          $ref: '#/components/responses/default_errors'
      security:
      - scmToken: []
    put:
      tags:
      - Log Forwarding Profiles
      summary: Update a log forwarding profile
      description: 'Update an existing log forwarding profile.

        '
      operationId: UpdateLogForwardingProfilesByID
      parameters:
      - $ref: '#/components/parameters/uuid'
      requestBody:
        description: OK
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/log-forwarding-profiles'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/log-forwarding-profiles'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic_with_body'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/conflict_errors'
        default:
          $ref: '#/components/responses/default_errors'
      security:
      - scmToken: []
    delete:
      tags:
      - Log Forwarding Profiles
      summary: Delete a log forwarding profile
      description: 'Delete a log forwarding profile.

        '
      operationId: DeleteLogForwardingProfilesByID
      parameters:
      - $ref: '#/components/parameters/uuid'
      responses:
        '200':
          $ref: '#/components/responses/http_ok'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/conflict_errors'
        default:
          $ref: '#/components/responses/default_errors'
      security:
      - scmToken: []
    servers:
    - url: https://api.strata.paloaltonetworks.com/config/objects/v1
      description: Current
    - url: https://api.sase.paloaltonetworks.com/sse/config/v1
      description: Legacy
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 59fcc104-7100-494b-b0c4-09f9dcc477d9
    LogForwardingProfile:
      type: object
      properties:
        profile_id:
          type: string
          description: Unique identifier of the profile.
          example: '960762'
        name:
          type: string
          description: Display name of the profile.
          example: Branch Sensor 06
        description:
          type: string
          description: Description of the profile's purpose.
          example: Threat monitoring investigation activity configured rule firewall traffic blocked investigation suspicious monitoring.
        log_types:
          type: array
          items:
            type: string
            enum:
            - traffic
            - threat
            - url
            - wildfire
            - auth
            - decryption
            - globalprotect
            - system
            - config
          description: Log types included in this forwarding profile.
          example:
          - config
        enabled:
          type: boolean
          description: Whether this profile is actively forwarding logs.
          example: false
        destination_count:
          type: integer
          description: Total number of configured destinations.
          example: 931
        created_at:
        

# --- truncated at 32 KB (51 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-log-forwarding-profiles-api-openapi.yml