Palo Alto Networks Policies API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Policies API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Policies
  description: Security policy recommendation operations.
paths:
  /policy/recommendation:
    get:
      operationId: getPolicyRecommendation
      summary: Palo Alto Networks Get Policy Recommendations
      description: Returns policy recommendations generated by the IoT Security service based on observed device behavior and communication patterns. Recommendations include suggested security rules, microsegmentation policies, and access control configurations that can be applied to Palo Alto Networks firewalls.
      tags:
      - Policies
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '134137'
      - name: deviceid
        in: query
        description: Filter recommendations for a specific device.
        schema:
          type: string
        example: '876712'
      responses:
        '200':
          description: Policy recommendations returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of recommendations.
                  recommendations:
                    type: array
                    items:
                      $ref: '#/components/schemas/PolicyRecommendation'
              examples:
                GetPolicyRecommendation200Example:
                  summary: Default getPolicyRecommendation 200 response
                  x-microcks-default: true
                  value:
                    total: 906
                    recommendations:
                    - id: example-id
                      deviceid: '738250'
                      profile: Network Printer
                      source_zone: dmz
                      destination_zone: dmz
                      applications:
                      - web-browsing
                      services:
                      - example-services_item
                      action: allow
                      confidence: 27.0
                      description: Blocked configured policy endpoint alert endpoint policy incident violation malware suspicious incident.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Policies/SecurityRules:
    get:
      operationId: listSecurityRules
      summary: Palo Alto Networks List Security Rules
      description: Returns all security policy rules configured in the specified rulebase. Security rules control traffic flow between zones and define actions (allow, deny, drop, reset) based on source, destination, application, service, and user criteria.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by security rule name.
        schema:
          type: string
        example: Staging Firewall 77
      responses:
        '200':
          description: Security rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/SecurityRule'
              examples:
                ListSecurityRules200Example:
                  summary: Default listSecurityRules 200 response
                  x-microcks-default: true
                  value:
                    '@status': enabled
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Branch Policy 11
                        from:
                          member:
                          - example-member_item
                          - example-member_item
                        to:
                          member:
                          - example-member_item
                        source:
                          member:
                          - example-member_item
                          - example-member_item
                        destination:
                          member:
                          - example-member_item
                          - example-member_item
                        source-user:
                          member:
                          - example-member_item
                        application:
                          member:
                          - example-member_item
                        service:
                          member:
                          - example-member_item
                          - example-member_item
                        category:
                          member:
                          - example-member_item
                          - example-member_item
                        action: drop
                        log-start: 'no'
                        log-end: 'yes'
                        log-setting: example-log-setting
                        profile-setting:
                          group:
                            member:
                            - example-member_item
                            - example-member_item
                        disabled: 'no'
                        description: Endpoint rule network investigation incident blocked detected applied investigation suspicious rule traffic.
                        tag:
                          member:
                          - example-member_item
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSecurityRule
      summary: Palo Alto Networks Create Security Rule
      description: Creates a new security policy rule. The rule is added to the rulebase in the specified position. Define source and destination zones, addresses, applications, services, and the action to take on matching traffic.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the security rule to create.
        schema:
          type: string
        example: Production Gateway 63
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/SecurityRule'
            examples:
              CreateSecurityRuleRequestExample:
                summary: Default createSecurityRule request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Policy 11
                    from:
                      member:
                      - example-member_item
                      - example-member_item
                    to:
                      member:
                      - example-member_item
                    source:
                      member:
                      - example-member_item
                      - example-member_item
                    destination:
                      member:
                      - example-member_item
                      - example-member_item
                    source-user:
                      member:
                      - example-member_item
                    application:
                      member:
                      - example-member_item
                    service:
                      member:
                      - example-member_item
                      - example-member_item
                    category:
                      member:
                      - example-member_item
                      - example-member_item
                    action: drop
                    log-start: 'no'
                    log-end: 'yes'
                    log-setting: example-log-setting
                    profile-setting:
                      group:
                        member:
                        - example-member_item
                        - example-member_item
                    disabled: 'no'
                    description: Endpoint rule network investigation incident blocked detected applied investigation suspicious rule traffic.
                    tag:
                      member:
                      - example-member_item
      responses:
        '200':
          description: Security rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateSecurityRule200Example:
                  summary: Default createSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateSecurityRule
      summary: Palo Alto Networks Update Security Rule
      description: Updates an existing security rule identified by name. The entire rule definition must be provided as this performs a full replacement.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the security rule to update.
        schema:
          type: string
        example: Corporate Firewall 56
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/SecurityRule'
            examples:
              UpdateSecurityRuleRequestExample:
                summary: Default updateSecurityRule request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Policy 11
                    from:
                      member:
                      - example-member_item
                      - example-member_item
                    to:
                      member:
                      - example-member_item
                    source:
                      member:
                      - example-member_item
                      - example-member_item
                    destination:
                      member:
                      - example-member_item
                      - example-member_item
                    source-user:
                      member:
                      - example-member_item
                    application:
                      member:
                      - example-member_item
                    service:
                      member:
                      - example-member_item
                      - example-member_item
                    category:
                      member:
                      - example-member_item
                      - example-member_item
                    action: drop
                    log-start: 'no'
                    log-end: 'yes'
                    log-setting: example-log-setting
                    profile-setting:
                      group:
                        member:
                        - example-member_item
                        - example-member_item
                    disabled: 'no'
                    description: Endpoint rule network investigation incident blocked detected applied investigation suspicious rule traffic.
                    tag:
                      member:
                      - example-member_item
      responses:
        '200':
          description: Security rule updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateSecurityRule200Example:
                  summary: Default updateSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteSecurityRule
      summary: Palo Alto Networks Delete Security Rule
      description: Deletes a security policy rule identified by name.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the security rule to delete.
        schema:
          type: string
        example: Branch Policy 56
      responses:
        '200':
          description: Security rule deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteSecurityRule200Example:
                  summary: Default deleteSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Policies/NATRules:
    get:
      operationId: listNatRules
      summary: Palo Alto Networks List NAT Rules
      description: Returns all NAT policy rules configured on the firewall. NAT rules define source NAT (SNAT), destination NAT (DNAT), and bidirectional translation policies applied to matching traffic flows.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by NAT rule name.
        schema:
          type: string
        example: Branch Policy 56
      responses:
        '200':
          description: NAT rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/NatRule'
              examples:
                ListNatRules200Example:
                  summary: Default listNatRules 200 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Corporate Policy 48
                        from:
                          member:
                          - example-member_item
                          - example-member_item
                        to:
                          member:
                          - example-member_item
                          - example-member_item
                        source:
                          member:
                          - example-member_item
                        destination:
                          member:
                          - example-member_item
                          - example-member_item
                        service: example-service
                        source-translation:
                          dynamic-ip-and-port:
                            interface-address:
                              interface: example-interface
                            translated-address:
                              member:
                              - example-member_item
                              - example-member_item
                          static-ip:
                            translated-address: example-translated-address
                            bi-directional: 'yes'
                        destination-translation:
                          translated-address: example-translated-address
                          translated-port: example-translated-port
                        nat-type: nat64
                        disabled: 'yes'
                        description: Suspicious endpoint network monitoring suspicious threat suspicious on Security.
                        tag:
                          member:
                          - example-member_item
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createNatRule
      summary: Palo Alto Networks Create NAT Rule
      description: Creates a new NAT policy rule. Define source and destination zones, addresses, services, and the translation type (static-ip, dynamic-ip, dynamic-ip-and-port) and parameters.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the NAT rule to create.
        schema:
          type: string
        example: Staging Firewall 40
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/NatRule'
            examples:
              CreateNatRuleRequestExample:
                summary: Default createNatRule request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Corporate Policy 48
                    from:
                      member:
                      - example-member_item
                      - example-member_item
                    to:
                      member:
                      - example-member_item
                      - example-member_item
                    source:
                      member:
                      - example-member_item
                    destination:
                      member:
                      - example-member_item
                      - example-member_item
                    service: example-service
                    source-translation:
                      dynamic-ip-and-port:
                        interface-address:
                          interface: example-interface
                        translated-address:
                          member:
                          - example-member_item
                          - example-member_item
                      static-ip:
                        translated-address: example-translated-address
                        bi-directional: 'yes'
                    destination-translation:
                      translated-address: example-translated-address
                      translated-port: example-translated-port
                    nat-type: nat64
                    disabled: 'yes'
                    description: Suspicious endpoint network monitoring suspicious threat suspicious on Security.
                    tag:
                      member:
                      - example-member_item
      responses:
        '200':
          description: NAT rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateNatRule200Example:
                  summary: Default createNatRule 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateNatRule
      summary: Palo Alto Networks Update NAT Rule
      description: Updates an existing NAT rule identified by name.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the NAT rule to update.
        schema:
          type: string
        example: Production Agent 11
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/NatRule'
            examples:
              UpdateNatRuleRequestExample:
                summary: Default updateNatRule request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Corporate Policy 48
                    from:
                      member:
                      - example-member_item
                      - example-member_item
                    to:
                      member:
                      - example-member_item
                      - example-member_item
                    source:
                      member:
                      - example-member_item
                    destination:
                      member:
                      - example-member_item
                      - example-member_item
                    service: example-service
                    source-translation:
                      dynamic-ip-and-port:
                        interface-address:
                          interface: example-interface
                        translated-address:
                          member:
                          - example-member_item
                          - example-member_item
                      static-ip:
                        translated-address: example-translated-address
                        bi-directional: 'yes'
                    destination-translation:
                      translated-address: example-translated-address
                      translated-port: example-translated-port
                    nat-type: nat64
                    disabled: 'yes'
                    description: Suspicious endpoint network monitoring suspicious threat suspicious on Security.
                    tag:
                      member:
                      - example-member_item
      responses:
        '200':
          description: NAT rule updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateNatRule200Example:
                  summary: Default updateNatRule 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteNatRule
      summary: Palo Alto Networks Delete NAT Rule
      description: Deletes a NAT policy rule identified by name.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the NAT rule to delete.
        schema:
          type: string
        example: Production Firewall 72
      responses:
        '200':
          description: NAT rule deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteNatRule200Example:
                  summary: Default deleteNatRule 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Policies/QoSRules:
    get:
      operationId: listQosRules
      summary: Palo Alto Networks List QoS Rules
      description: Returns all QoS policy rules configured on the firewall. QoS rules classify and prioritize network traffic to ensure bandwidth allocation and low-latency delivery for critical applications.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by QoS rule name.
        schema:
          type: string
        example: Primary Firewall 08
      responses:
        '200':
          description: QoS rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/QosRule'
              examples:
                ListQosRules200Example:
                  summary: Default listQosRules 200 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Staging Policy 36
                        from:
                          member:
                          - example-member_item
                        to:
                          member:
                          - example-member_item
                        source:
                          member:
                          - example-member_item
                        destination:
                          member:
                          - example-member_item
                        application:
                          member:
                          - example-member_item
                          - example-member_item
                        service:
                          member:
                          - example-member_item
                        dscp-tos:
                          any: {}
                        action:
                          class: example-class
                        disabled: 'no'
                        description: Rule blocked Security firewall policy applied suspicious detected firewall endpoint network investigation.
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createQosRule
      summary: Palo Alto Networks Create QoS Rule
      description: Creates a new QoS policy rule that classifies matching traffic into a QoS class for bandwidth management and prioritization.
      tags:
      - Policies
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the QoS rule to create.
        schema:
          type: string
        example: Corporate Policy 81
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/QosRule'
            examples:
              CreateQosRuleRequestExample:
                summary: Default createQosRule request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Policy 36
                    from:
                      member:
                      - example-member_item
                    to:
                      member:
                      - example-member_item
                    source:
                      member:
                      - example-member_item
                    destination:
                      member:
                      - example-member_item
                    application:
                      member:
                      - example-member_item
                      - example-member_item
                    service:
                      member:
                      - example-member_item
                    dscp-tos:
                      any: {}
                    action:
                      class: example-class
                    disabled: 'no'
                    description: Rule blocked Security firewall policy applied suspicious detected firewall endpoint network investigation.
      responses:
        '200':
          description

# --- truncated at 32 KB (117 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-policies-api-openapi.yml