Palo Alto Networks Objects API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Objects API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Objects
  description: Address objects, address groups, service objects, service groups, and tag management.
paths:
  /Objects/Addresses:
    get:
      operationId: listAddresses
      summary: Palo Alto Networks List Address Objects
      description: Returns all address objects configured on the firewall. Supports filtering by name and location (vsys, device group, or shared). Address objects define IP addresses, IP ranges, IP subnets, or FQDNs used in security policy rules.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by address object name.
        schema:
          type: string
        example: Production Firewall 09
      responses:
        '200':
          description: Address objects returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                    example: success
                  '@code':
                    type: string
                    example: '19'
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Address'
              examples:
                ListAddresses200Example:
                  summary: Default listAddresses 200 response
                  x-microcks-default: true
                  value:
                    '@status': success
                    '@code': '19'
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Production Firewall 76
                        ip-netmask: example-ip-netmask
                        ip-range: example-ip-range
                        ip-wildcard: example-ip-wildcard
                        fqdn: api.acme-systems.org
                        description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                        tag: &id001
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Production Firewall 76
                        ip-netmask: example-ip-netmask
                        ip-range: example-ip-range
                        ip-wildcard: example-ip-wildcard
                        fqdn: api.acme-systems.org
                        description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                        tag: *id001
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddress
      summary: Palo Alto Networks Create Address Object
      description: Creates a new address object on the firewall. The address object can be of type ip-netmask, ip-range, ip-wildcard, or fqdn. The object must have a unique name within the specified location scope. Changes are staged in candidate configuration until committed.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to create.
        schema:
          type: string
        example: Staging Policy 66
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Address'
            examples:
              CreateAddressRequestExample:
                summary: Default createAddress request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Firewall 76
                    ip-netmask: example-ip-netmask
                    ip-range: example-ip-range
                    ip-wildcard: example-ip-wildcard
                    fqdn: api.acme-systems.org
                    description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateAddress200Example:
                  summary: Default createAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          description: Address object with the specified name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAddress409Example:
                  summary: Default createAddress 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg:
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddress
      summary: Palo Alto Networks Update Address Object
      description: Updates an existing address object identified by name. The entire object definition must be provided in the request body as this performs a full replacement of the address object configuration.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to update.
        schema:
          type: string
        example: Branch Agent 74
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Address'
            examples:
              UpdateAddressRequestExample:
                summary: Default updateAddress request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Firewall 76
                    ip-netmask: example-ip-netmask
                    ip-range: example-ip-range
                    ip-wildcard: example-ip-wildcard
                    fqdn: api.acme-systems.org
                    description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateAddress200Example:
                  summary: Default updateAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddress
      summary: Palo Alto Networks Delete Address Object
      description: Deletes an address object identified by name. The object cannot be deleted if it is referenced by an active security policy rule or address group. Remove all references before deleting.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to delete.
        schema:
          type: string
        example: Production Agent 38
      responses:
        '200':
          description: Address object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteAddress200Example:
                  summary: Default deleteAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Object is referenced by other configuration elements.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAddress409Example:
                  summary: Default deleteAddress 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg:
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/AddressGroups:
    get:
      operationId: listAddressGroups
      summary: Palo Alto Networks List Address Groups
      description: Returns all address groups configured on the firewall. Address groups contain address objects or other address groups and can be static (explicit member list) or dynamic (tag-based membership criteria).
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by address group name.
        schema:
          type: string
        example: Corporate Sensor 37
      responses:
        '200':
          description: Address groups returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/AddressGroup'
              examples:
                ListAddressGroups200Example:
                  summary: Default listAddressGroups 200 response
                  x-microcks-default: true
                  value:
                    '@status': enabled
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Branch Agent 57
                        static: &id002
                          member:
                          - example-member_item
                        dynamic: &id003
                          filter: example-filter
                        description: Policy alert detected violation network network violation suspicious on malware network.
                        tag: &id004
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Branch Agent 57
                        static: *id002
                        dynamic: *id003
                        description: Policy alert detected violation network network violation suspicious on malware network.
                        tag: *id004
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddressGroup
      summary: Palo Alto Networks Create Address Group
      description: Creates a new address group. The group can be static with an explicit list of member address objects, or dynamic with a tag-based filter expression that automatically includes matching address objects.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to create.
        schema:
          type: string
        example: Primary Policy 55
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/AddressGroup'
            examples:
              CreateAddressGroupRequestExample:
                summary: Default createAddressGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Agent 57
                    static:
                      member:
                      - example-member_item
                    dynamic:
                      filter: example-filter
                    description: Policy alert detected violation network network violation suspicious on malware network.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateAddressGroup200Example:
                  summary: Default createAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          description: Address group with the specified name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAddressGroup409Example:
                  summary: Default createAddressGroup 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg:
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddressGroup
      summary: Palo Alto Networks Update Address Group
      description: Updates an existing address group identified by name. The entire group definition must be provided as this performs a full replacement.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to update.
        schema:
          type: string
        example: Branch Agent 78
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/AddressGroup'
            examples:
              UpdateAddressGroupRequestExample:
                summary: Default updateAddressGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Agent 57
                    static:
                      member:
                      - example-member_item
                    dynamic:
                      filter: example-filter
                    description: Policy alert detected violation network network violation suspicious on malware network.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Address group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateAddressGroup200Example:
                  summary: Default updateAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddressGroup
      summary: Palo Alto Networks Delete Address Group
      description: Deletes an address group identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to delete.
        schema:
          type: string
        example: Primary Gateway 21
      responses:
        '200':
          description: Address group deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteAddressGroup200Example:
                  summary: Default deleteAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/Services:
    get:
      operationId: listServices
      summary: Palo Alto Networks List Service Objects
      description: Returns all service objects configured on the firewall. Service objects define TCP or UDP protocol and port combinations used in security policy rules to identify specific network services.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by service object name.
        schema:
          type: string
        example: Primary Gateway 90
      responses:
        '200':
          description: Service objects returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Service'
              examples:
                ListServices200Example:
                  summary: Default listServices 200 response
                  x-microcks-default: true
                  value:
                    '@status': active
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Staging Firewall 44
                        protocol: &id005
                          tcp:
                            port: example-port
                            source-port: example-source-port
                          udp:
                            port: example-port
                            source-port: example-source-port
                        description: On endpoint traffic rule alert blocked.
                        tag: &id006
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Staging Firewall 44
                        protocol: *id005
                        description: On endpoint traffic rule alert blocked.
                        tag: *id006
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createService
      summary: Palo Alto Networks Create Service Object
      description: Creates a new service object defining a TCP or UDP protocol with destination port or port range.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to create.
        schema:
          type: string
        example: Corporate Sensor 55
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Service'
            examples:
              CreateServiceRequestExample:
                summary: Default createService request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Firewall 44
                    protocol:
                      tcp:
                        port: example-port
                        source-port: example-source-port
                      udp:
                        port: example-port
                        source-port: example-source-port
                    description: On endpoint traffic rule alert blocked.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Service object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateService200Example:
                  summary: Default createService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateService
      summary: Palo Alto Networks Update Service Object
      description: Updates an existing service object identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to update.
        schema:
          type: string
        example: Branch Gateway 83
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Service'
            examples:
              UpdateServiceRequestExample:
                summary: Default updateService request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Firewall 44
                    protocol:
                      tcp:
                        port: example-port
                        source-port: example-source-port
                      udp:
                        port: example-port
                        source-port: example-source-port
                    description: On endpoint traffic rule alert blocked.
                    tag:
                      member:
                      - example-member_item
                      - example-member_item
      responses:
        '200':
          description: Service object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateService200Example:
                  summary: Default updateService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteService
      summary: Palo Alto Networks Delete Service Object
      description: Deletes a service object identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to delete.
        schema:
          type: string
        example: Staging Agent 83
      responses:
        '200':
          description: Service object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteService200Example:
                  summary: Default deleteService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/ServiceGroups:
    get:
      operationId: listServiceGroups
      summary: Palo Alto Networks List Service Groups
      description: Returns all service groups configured on the firewall. Service groups aggregate multiple service objects for use in security policy rules.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by service group name.
        schema:
          type: string
        example: Corporate Sensor 06
      responses:
        '200':
          description: Service groups returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/ServiceGroup'
              examples:
                ListServiceGroups200Example:
                  summary: Default listServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    '@status': active
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Primary Policy 84
                        members: &id007
                          member:
                          - example-member_item
                          - example-member_item
                        tag: &id008
                          member:
                          - example-member_item
                      - '@name': Primary Policy 84
                        members: *id007
                        tag: *id008
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createServiceGroup
      summary: Palo Alto Networks Create Service Group
      description: Creates a new service group containing one or more service objects.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service group to create.
        schema:
          type: string
        example: Staging Policy 14
      requestBody:
        required: true
        content:
          application/json:
            schema:
              t

# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-objects-api-openapi.yml