Palo Alto Networks Remote Networks API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Remote Networks API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Remote Networks
  description: Remote network IPsec tunnel management.
paths:
  /remote-networks:
    get:
      operationId: listRemoteNetworks
      summary: Palo Alto Networks List Remote Networks
      description: Returns the list of remote network tunnel configurations for the tenant. Remote networks represent branch offices or data centers connected to Prisma Access via IPsec tunnels. Each entry includes the tunnel configuration, IKE gateway parameters, and current connection status.
      tags:
      - Remote Networks
      parameters:
      - name: location
        in: query
        description: Filter remote networks by Prisma Access location.
        schema:
          type: string
        example: example-location
      - name: status
        in: query
        description: Filter by tunnel connection status.
        schema:
          type: string
          enum:
          - connected
          - disconnected
          - pending
        example: disconnected
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of remote networks to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Remote networks returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/RemoteNetwork'
              examples:
                ListRemoteNetworks200Example:
                  summary: Default listRemoteNetworks 200 response
                  x-microcks-default: true
                  value:
                    total: 189
                    offset: 294
                    limit: 636
                    items:
                    - id: example-id
                      name: Production Agent 92
                      description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                      location: example-location
                      subnets:
                      - 10.66.40.0/24
                      ike_gateway:
                        peer_ip: example-peer_ip
                        peer_id: '176162'
                        local_ip: example-local_ip
                        ike_version: IKEv2
                        authentication_type: certificate
                      ipsec_tunnel:
                        local_address: example-local_address
                        remote_address: example-remote_address
                        tunnel_interface: example-tunnel_interface
                      tunnel_status: connected
                      bandwidth_mbps: 309
                      created_at: '2024-10-27T07:17:45Z'
                      updated_at: '2026-09-09T21:35:55Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks400Example:
                  summary: Default listRemoteNetworks 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks401Example:
                  summary: Default listRemoteNetworks 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks403Example:
                  summary: Default listRemoteNetworks 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks500Example:
                  summary: Default listRemoteNetworks 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createRemoteNetwork
      summary: Palo Alto Networks Create Remote Network
      description: Creates a new remote network tunnel configuration. Provisions an IPsec tunnel between the specified branch location and the nearest Prisma Access gateway. The IKE gateway configuration is automatically generated unless custom parameters are provided.
      tags:
      - Remote Networks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetworkRequest'
            examples:
              CreateRemoteNetworkRequestExample:
                summary: Default createRemoteNetwork request
                x-microcks-default: true
                value:
                  name: Primary Agent 21
                  description: Alert activity rule blocked firewall incident activity rule.
                  location: example-location
                  subnets:
                  - 10.239.225.0/24
                  ike_gateway:
                    peer_ip: example-peer_ip
                    peer_id: '846951'
                    ike_version: IKEv2
                    authentication_type: pre-shared-key
                    pre_shared_key: example-pre_shared_key
                  bandwidth_mbps: 945
      responses:
        '201':
          description: Remote network created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                CreateRemoteNetwork201Example:
                  summary: Default createRemoteNetwork 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Production Agent 92
                    description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                    location: example-location
                    subnets:
                    - 10.66.40.0/24
                    ike_gateway:
                      peer_ip: example-peer_ip
                      peer_id: '176162'
                      local_ip: example-local_ip
                      ike_version: IKEv2
                      authentication_type: certificate
                    ipsec_tunnel:
                      local_address: example-local_address
                      remote_address: example-remote_address
                      tunnel_interface: example-tunnel_interface
                    tunnel_status: connected
                    bandwidth_mbps: 309
                    created_at: '2024-10-27T07:17:45Z'
                    updated_at: '2026-09-09T21:35:55Z'
        '400':
          description: Invalid request body or configuration.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork400Example:
                  summary: Default createRemoteNetwork 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork401Example:
                  summary: Default createRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork403Example:
                  summary: Default createRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '409':
          description: A remote network with this name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork409Example:
                  summary: Default createRemoteNetwork 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork500Example:
                  summary: Default createRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /remote-networks/{id}:
    get:
      operationId: getRemoteNetwork
      summary: Palo Alto Networks Get Remote Network
      description: Returns full details for a specific remote network tunnel configuration.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Remote network details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                GetRemoteNetwork200Example:
                  summary: Default getRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Production Agent 92
                    description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                    location: example-location
                    subnets:
                    - 10.66.40.0/24
                    ike_gateway:
                      peer_ip: example-peer_ip
                      peer_id: '176162'
                      local_ip: example-local_ip
                      ike_version: IKEv2
                      authentication_type: certificate
                    ipsec_tunnel:
                      local_address: example-local_address
                      remote_address: example-remote_address
                      tunnel_interface: example-tunnel_interface
                    tunnel_status: connected
                    bandwidth_mbps: 309
                    created_at: '2024-10-27T07:17:45Z'
                    updated_at: '2026-09-09T21:35:55Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork401Example:
                  summary: Default getRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork403Example:
                  summary: Default getRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork404Example:
                  summary: Default getRemoteNetwork 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork500Example:
                  summary: Default getRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateRemoteNetwork
      summary: Palo Alto Networks Update Remote Network
      description: Updates an existing remote network tunnel configuration.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network to update.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetworkRequest'
            examples:
              UpdateRemoteNetworkRequestExample:
                summary: Default updateRemoteNetwork request
                x-microcks-default: true
                value:
                  name: Primary Agent 21
                  description: Alert activity rule blocked firewall incident activity rule.
                  location: example-location
                  subnets:
                  - 10.239.225.0/24
                  ike_gateway:
                    peer_ip: example-peer_ip
                    peer_id: '846951'
                    ike_version: IKEv2
                    authentication_type: pre-shared-key
                    pre_shared_key: example-pre_shared_key
                  bandwidth_mbps: 945
      responses:
        '200':
          description: Remote network updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                UpdateRemoteNetwork200Example:
                  summary: Default updateRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Production Agent 92
                    description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                    location: example-location
                    subnets:
                    - 10.66.40.0/24
                    ike_gateway:
                      peer_ip: example-peer_ip
                      peer_id: '176162'
                      local_ip: example-local_ip
                      ike_version: IKEv2
                      authentication_type: certificate
                    ipsec_tunnel:
                      local_address: example-local_address
                      remote_address: example-remote_address
                      tunnel_interface: example-tunnel_interface
                    tunnel_status: connected
                    bandwidth_mbps: 309
                    created_at: '2024-10-27T07:17:45Z'
                    updated_at: '2026-09-09T21:35:55Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork400Example:
                  summary: Default updateRemoteNetwork 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork401Example:
                  summary: Default updateRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork403Example:
                  summary: Default updateRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork404Example:
                  summary: Default updateRemoteNetwork 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork500Example:
                  summary: Default updateRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteRemoteNetwork
      summary: Palo Alto Networks Delete Remote Network
      description: Deletes a remote network tunnel configuration and tears down the associated IPsec tunnel.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network to delete.
        schema:
          type: string
        example: example-id
      responses:
        '204':
          description: Remote network deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork401Example:
                  summary: Default deleteRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork403Example:
                  summary: Default deleteRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork404Example:
                  summary: Default deleteRemoteNetwork 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork500Example:
                  summary: Default deleteRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /remote-networks/{id}/refresh-ike-gateway:
    post:
      operationId: refreshIKEGateway
      summary: Palo Alto Networks Refresh IKE Gateway
      description: Initiates an IKE gateway refresh for a remote network tunnel. Use this endpoint to re-establish an IPsec tunnel that has failed or to apply updated IKE parameters after a configuration change.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IKE gateway refresh initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Remote network identifier.
                  status:
                    type: string
                    enum:
                    - refreshing
                    description: Current refresh status.
                  initiated_at:
                    type: string
                    format: date-time
              examples:
                RefreshIkegateway200Example:
                  summary: Default refreshIKEGateway 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    status: refreshing
                    initiated_at: '2024-06-11T09:35:45Z'
        '400':
          description: Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway400Example:
                  summary: Default refreshIKEGateway 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway401Example:
                  summary: Default refreshIKEGateway 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway403Example:
                  summary: Default refreshIKEGateway 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway404Example:
                  summary: Default refreshIKEGateway 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway500Example:
                  summary: Default refreshIKEGateway 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    RemoteNetwork:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the remote network.
          example: example-id
        name:
          type: string
          description: Display name of the remote network.
          example: Production Agent 92
        description:
          type: string
          description: Description of the remote network's location or purpose.
          example: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
        location:
          type: string
          description: Prisma Access gateway location for this tunnel.
          example: example-location
        subnets:
          type: array
          items:
            type: string
          description: Network subnets at the remote site (CIDR notation).
          example:
          - 10.66.40.0/24
        ike_gateway:
          $ref: '#/components/schemas/IKEGateway'
        ipsec_tunnel:
          $ref: '#/components/schemas/IPsecTunnel'
        tunnel_status:
          type: string
          enum:
          - connected
          - disconnected
          - pending
          - error
          description: Current IPsec tunnel connection status.
          example: connected
        bandwidth_mbps:
          type: integer
          description: Allocated bandwidth in Mbps for this remote network.
          example: 309
        created_at:
          type: string
          format: date-time
          example: '2024-10-27T07:17:45Z'
        updated_at:
          type: string
          format: date-time
          example: '2026-09-09T21:35:55Z'
    IPsecTunnel:
      type: object
      properties:
        local_address:
          type: string
          description: Local tunnel IP address assigned by Prisma Access.
          example: example-local_address
        remote_address:
          type: string
          description: Remote tunnel IP address.
          example: example-remote_address
        tunnel_interface:
          

# --- truncated at 32 KB (35 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-remote-networks-api-openapi.yml