Palo Alto Networks RuleStacks API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend RuleStacks API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: RuleStacks
  description: Rule stack management. Rule stacks contain the security policy applied to Cloud NGFW instances.
paths:
  /config/rulestacks:
    get:
      operationId: listRuleStacks
      summary: Palo Alto Networks List Rule Stacks
      description: Returns a paginated list of all rule stacks in the account. Rule stacks contain security rules, FQDN lists, prefix lists, and security profiles that define the firewall policy applied to Cloud NGFW instances.
      tags:
      - RuleStacks
      parameters:
      - name: maxresults
        in: query
        description: Maximum number of rule stacks to return per page.
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      - name: nexttoken
        in: query
        description: Pagination token from a previous response.
        schema:
          type: string
        example: example-nexttoken
      - name: scope
        in: query
        description: Scope filter for rule stacks.
        schema:
          type: string
          enum:
          - Local
          - Global
        example: Global
      responses:
        '200':
          description: Rule stacks returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      RuleStackCandidates:
                        type: array
                        items:
                          $ref: '#/components/schemas/RuleStackSummary'
                      NextToken:
                        type: string
                        description: Token for retrieving the next page of results.
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListRuleStacks200Example:
                  summary: Default listRuleStacks 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      RuleStackCandidates:
                      - RuleStackName: Corporate Sensor 39
                        Scope: Local
                        Status: ACTIVE
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createRuleStack
      summary: Palo Alto Networks Create Rule Stack
      description: Creates a new rule stack. A rule stack is a container for firewall policy including security rules, FQDN lists, and prefix lists. Rule stacks are associated with Cloud NGFW firewall instances to define their security policy.
      tags:
      - RuleStacks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuleStackRequest'
            examples:
              CreateRuleStackRequestExample:
                summary: Default createRuleStack request
                x-microcks-default: true
                value:
                  RuleStackName: Branch Policy 33
                  RuleStackEntry:
                    Description: Firewall endpoint applied malware violation network activity detected violation threat.
                    Scope: Local
                    MinAppIdVersion: 2.0.3
                    Profile:
                      AntiSpywareProfile: HVAC Controller
                      AntiVirusProfile: HVAC Controller
                      VulnerabilityProfile: HVAC Controller
                      URLFilteringProfile: HVAC Controller
      responses:
        '200':
          description: Rule stack created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/RuleStack'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateRuleStack200Example:
                  summary: Default createRuleStack 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      RuleStackName: Primary Agent 48
                      RuleStackEntry:
                        Description: Detected monitoring blocked endpoint Security Security on detected.
                        Scope: Local
                        MinAppIdVersion: 7.5.1
                        LookupXForwardedFor: None
                        Profile:
                          AntiSpywareProfile: Network Printer
                          AntiVirusProfile: HVAC Controller
                          VulnerabilityProfile: HVAC Controller
                          URLFilteringProfile: Network Printer
                          FileBlockingProfile: Network Printer
                      UpdateToken: example-UpdateToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /config/rulestacks/{rulestack}:
    get:
      operationId: getRuleStack
      summary: Palo Alto Networks Get Rule Stack
      description: Returns the configuration of a specific rule stack by name.
      tags:
      - RuleStacks
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - name: candidate
        in: query
        description: Return candidate (uncommitted) configuration if true.
        schema:
          type: boolean
          default: false
        example: false
      responses:
        '200':
          description: Rule stack returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/RuleStack'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                GetRuleStack200Example:
                  summary: Default getRuleStack 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      RuleStackName: Primary Agent 48
                      RuleStackEntry:
                        Description: Detected monitoring blocked endpoint Security Security on detected.
                        Scope: Local
                        MinAppIdVersion: 7.5.1
                        LookupXForwardedFor: None
                        Profile:
                          AntiSpywareProfile: Network Printer
                          AntiVirusProfile: HVAC Controller
                          VulnerabilityProfile: HVAC Controller
                          URLFilteringProfile: Network Printer
                          FileBlockingProfile: Network Printer
                      UpdateToken: example-UpdateToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateRuleStack
      summary: Palo Alto Networks Update Rule Stack
      description: Updates the configuration of an existing rule stack. Changes are staged in candidate configuration until committed via the commit endpoint.
      tags:
      - RuleStacks
      parameters:
      - $ref: '#/components/parameters/rulestack'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuleStackRequest'
            examples:
              UpdateRuleStackRequestExample:
                summary: Default updateRuleStack request
                x-microcks-default: true
                value:
                  RuleStackName: Branch Policy 33
                  RuleStackEntry:
                    Description: Firewall endpoint applied malware violation network activity detected violation threat.
                    Scope: Local
                    MinAppIdVersion: 2.0.3
                    Profile:
                      AntiSpywareProfile: HVAC Controller
                      AntiVirusProfile: HVAC Controller
                      VulnerabilityProfile: HVAC Controller
                      URLFilteringProfile: HVAC Controller
      responses:
        '200':
          description: Rule stack updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/RuleStack'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                UpdateRuleStack200Example:
                  summary: Default updateRuleStack 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      RuleStackName: Primary Agent 48
                      RuleStackEntry:
                        Description: Detected monitoring blocked endpoint Security Security on detected.
                        Scope: Local
                        MinAppIdVersion: 7.5.1
                        LookupXForwardedFor: None
                        Profile:
                          AntiSpywareProfile: Network Printer
                          AntiVirusProfile: HVAC Controller
                          VulnerabilityProfile: HVAC Controller
                          URLFilteringProfile: Network Printer
                          FileBlockingProfile: Network Printer
                      UpdateToken: example-UpdateToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteRuleStack
      summary: Palo Alto Networks Delete Rule Stack
      description: Deletes a rule stack. The rule stack must not be associated with any active Cloud NGFW firewall instances before deletion.
      tags:
      - RuleStacks
      parameters:
      - $ref: '#/components/parameters/rulestack'
      responses:
        '200':
          description: Rule stack deleted successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                DeleteRuleStack200Example:
                  summary: Default deleteRuleStack 200 response
                  x-microcks-default: true
                  value:
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /config/rulestacks/{rulestack}/commit:
    post:
      operationId: commitRuleStack
      summary: Palo Alto Networks Commit Rule Stack
      description: Commits the candidate configuration of the rule stack to the running configuration. This applies all staged changes to active Cloud NGFW firewall instances associated with this rule stack.
      tags:
      - RuleStacks
      parameters:
      - $ref: '#/components/parameters/rulestack'
      responses:
        '200':
          description: Rule stack commit initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      CommitStatus:
                        type: string
                        enum:
                        - CommitSuccess
                        - CommitFailed
                        - CommitInProgress
                      JobId:
                        type: string
                        description: Job ID to poll for commit completion status.
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CommitRuleStack200Example:
                  summary: Default commitRuleStack 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      CommitStatus: CommitFailed
                      JobId: '850717'
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Insufficient IAM permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or cannot be modified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid AWS credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: An internal server error occurred.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    RuleStack:
      type: object
      description: A rule stack containing security policy for Cloud NGFW firewall instances.
      properties:
        RuleStackName:
          type: string
          description: Unique name of the rule stack.
          example: Primary Agent 48
        RuleStackEntry:
          type: object
          properties:
            Description:
              type: string
              example: Incident rule network detected investigation applied threat incident Security suspicious blocked activity.
            Scope:
              type: string
              enum:
              - Local
              - Global
              example: Local
            MinAppIdVersion:
              type: string
              description: Minimum App-ID content version required.
              example: 5.7.7
            LookupXForwardedFor:
              type: string
              enum:
              - SecurityPolicy
              - None
              example: SecurityPolicy
            Profile:
              type: object
              properties:
                AntiSpywareProfile:
                  type: string
                  example: IP Camera
                AntiVirusProfile:
                  type: string
                  example: IP Camera
                VulnerabilityProfile:
                  type: string
                  example: IP Camera
                URLFilteringProfile:
                  type: string
                  example: Network Printer
                FileBlockingProfile:
                  type: string
                  example: HVAC Controller
              example:
                AntiSpywareProfile: IP Camera
                AntiVirusProfile: Network Printer
                VulnerabilityProfile: HVAC Controller
                URLFilteringProfile: HVAC Controller
                FileBlockingProfile: HVAC Controller
          example:
            Description: Detected monitoring blocked endpoint Security Security on detected.
            Scope: Local
            MinAppIdVersion: 7.5.1
            LookupXForwardedFor: None
            Profile:
              AntiSpywareProfile: Network Printer
              AntiVirusProfile: HVAC Controller
              VulnerabilityProfile: HVAC Controller
              URLFilteringProfile: Network Printer
              FileBlockingProfile: Network Printer
        UpdateToken:
          type: string
          description: Optimistic lock token for concurrent modification detection.
          example: example-UpdateToken
    RuleStackSummary:
      type: object
      properties:
        RuleStackName:
          type: string
          example: Corporate Sensor 39
        Scope:
          type: string
          enum:
          - Local
          - Global
          example: Local
        Status:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
          - ERROR
          example: ACTIVE
    ErrorResponse:
      type: object
      properties:
        ResponseStatus:
          type: object
          properties:
            ErrorCode:
              type: integer
              example: 869
            Reason:
              type: string
              example: Blocked investigation activity firewall activity malware network on applied.
          example:
            ErrorCode: 719
            Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
    RuleStackRequest:
      type: object
      required:
      - RuleStackName
      - RuleStackEntry
      properties:
        RuleStackName:
          type: string
          example: Branch Policy 33
        RuleStackEntry:
          type: object
          properties:
            Description:
              type: string
              example: Endpoint activity incident network monitoring investigation.
            Scope:
              type: string
              enum:
              - Local
              - Global
              default: Local
              example: Local
            MinAppIdVersion:
              type: string
              example: 8.8.3
            Profile:
              type: object
              properties:
                AntiSpywareProfile:
                  type: string
                  example: Network Printer
                AntiVirusProfile:
                  type: string
                  example: IP Camera
                VulnerabilityProfile:
                  type: string
                  example: IP Camera
                URLFilteringProfile:
                  type: string
                  example: IP Camera
              example:
                AntiSpywareProfile: IP Camera
                AntiVirusProfile: Network Printer
                VulnerabilityProfile: IP Camera
                URLFilteringProfile: Network Printer
          example:
            Description: Firewall endpoint applied malware violation network activity detected violation threat.
            Scope: Local
            MinAppIdVersion: 2.0.3
            Profile:
              AntiSpywareProfile: HVAC Controller
              AntiVirusProfile: HVAC Controller
              VulnerabilityProfile: HVAC Controller
              URLFilteringProfile: HVAC Controller
    ResponseStatus:
      type: object
      description: Standard API response status envelope included in all responses.
      properties:
        ErrorCode:
          type: integer
          description: Error code. 0 indicates success.
          example: 0
        Reason:
          type: string
          description: Human-readable status message.
          example: ''
  parameters:
    rulestack:
      name: rulestack
      in: path
      required: true
      description: Name of the rule stack.
      schema:
        type: string
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.