Palo Alto Networks Security Policies API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Security Policies API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Security Policies
  description: 5G security policy management.
paths:
  /security-policies:
    get:
      operationId: list5GSecurityPolicies
      summary: Palo Alto Networks List 5G Security Policies
      description: Returns the list of 5G security policies. Security policies define the inspection and enforcement rules applied to 5G network traffic for specific network slices or subscriber groups.
      tags:
      - Security Policies
      parameters:
      - name: slice_id
        in: query
        description: Filter policies by associated network slice.
        schema:
          type: string
        example: '393635'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of policies to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Security policies returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SecurityPolicy5G'
              examples:
                List5GsecurityPolicies200Example:
                  summary: Default list5GSecurityPolicies 200 response
                  x-microcks-default: true
                  value:
                    total: 311
                    offset: 830
                    limit: 717
                    items:
                    - policy_id: '663558'
                      name: Staging Policy 94
                      description: Alert rule network investigation endpoint traffic rule rule policy blocked.
                      threat_prevention: false
                      url_filtering: true
                      app_identification: false
                      decryption: false
                      log_forwarding: false
                      enabled: true
                      created_at: '2026-04-11T03:07:30Z'
                      updated_at: '2025-02-26T20:56:47Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                List5GsecurityPolicies401Example:
                  summary: Default list5GSecurityPolicies 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                List5GsecurityPolicies403Example:
                  summary: Default list5GSecurityPolicies 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                List5GsecurityPolicies500Example:
                  summary: Default list5GSecurityPolicies 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: create5GSecurityPolicy
      summary: Palo Alto Networks Create 5G Security Policy
      description: Creates a new 5G security policy.
      tags:
      - Security Policies
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityPolicy5GRequest'
            examples:
              Create5GsecurityPolicyRequestExample:
                summary: Default create5GSecurityPolicy request
                x-microcks-default: true
                value:
                  name: Staging Firewall 55
                  description: Suspicious activity violation suspicious alert investigation policy applied incident investigation.
                  threat_prevention: true
                  url_filtering: false
                  app_identification: true
                  decryption: false
                  log_forwarding: true
                  enabled: true
      responses:
        '201':
          description: Security policy created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPolicy5G'
              examples:
                Create5GsecurityPolicy201Example:
                  summary: Default create5GSecurityPolicy 201 response
                  x-microcks-default: true
                  value:
                    policy_id: '663558'
                    name: Staging Policy 94
                    description: Alert rule network investigation endpoint traffic rule rule policy blocked.
                    threat_prevention: false
                    url_filtering: true
                    app_identification: false
                    decryption: false
                    log_forwarding: false
                    enabled: true
                    created_at: '2026-04-11T03:07:30Z'
                    updated_at: '2025-02-26T20:56:47Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Create5GsecurityPolicy400Example:
                  summary: Default create5GSecurityPolicy 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Create5GsecurityPolicy401Example:
                  summary: Default create5GSecurityPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Create5GsecurityPolicy403Example:
                  summary: Default create5GSecurityPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Create5GsecurityPolicy500Example:
                  summary: Default create5GSecurityPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /security-policies/{policy_id}:
    get:
      operationId: get5GSecurityPolicy
      summary: Palo Alto Networks Get 5G Security Policy
      description: Returns full details for a specific 5G security policy.
      tags:
      - Security Policies
      parameters:
      - name: policy_id
        in: path
        required: true
        description: Unique identifier of the security policy.
        schema:
          type: string
        example: '921336'
      responses:
        '200':
          description: Security policy details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPolicy5G'
              examples:
                Get5GsecurityPolicy200Example:
                  summary: Default get5GSecurityPolicy 200 response
                  x-microcks-default: true
                  value:
                    policy_id: '663558'
                    name: Staging Policy 94
                    description: Alert rule network investigation endpoint traffic rule rule policy blocked.
                    threat_prevention: false
                    url_filtering: true
                    app_identification: false
                    decryption: false
                    log_forwarding: false
                    enabled: true
                    created_at: '2026-04-11T03:07:30Z'
                    updated_at: '2025-02-26T20:56:47Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Get5GsecurityPolicy401Example:
                  summary: Default get5GSecurityPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Get5GsecurityPolicy403Example:
                  summary: Default get5GSecurityPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '404':
          description: Security policy not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Get5GsecurityPolicy404Example:
                  summary: Default get5GSecurityPolicy 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Get5GsecurityPolicy500Example:
                  summary: Default get5GSecurityPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: update5GSecurityPolicy
      summary: Palo Alto Networks Update 5G Security Policy
      description: Updates an existing 5G security policy.
      tags:
      - Security Policies
      parameters:
      - name: policy_id
        in: path
        required: true
        description: Unique identifier of the security policy to update.
        schema:
          type: string
        example: '868276'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityPolicy5GRequest'
            examples:
              Update5GsecurityPolicyRequestExample:
                summary: Default update5GSecurityPolicy request
                x-microcks-default: true
                value:
                  name: Staging Firewall 55
                  description: Suspicious activity violation suspicious alert investigation policy applied incident investigation.
                  threat_prevention: true
                  url_filtering: false
                  app_identification: true
                  decryption: false
                  log_forwarding: true
                  enabled: true
      responses:
        '200':
          description: Security policy updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPolicy5G'
              examples:
                Update5GsecurityPolicy200Example:
                  summary: Default update5GSecurityPolicy 200 response
                  x-microcks-default: true
                  value:
                    policy_id: '663558'
                    name: Staging Policy 94
                    description: Alert rule network investigation endpoint traffic rule rule policy blocked.
                    threat_prevention: false
                    url_filtering: true
                    app_identification: false
                    decryption: false
                    log_forwarding: false
                    enabled: true
                    created_at: '2026-04-11T03:07:30Z'
                    updated_at: '2025-02-26T20:56:47Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Update5GsecurityPolicy400Example:
                  summary: Default update5GSecurityPolicy 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Update5GsecurityPolicy401Example:
                  summary: Default update5GSecurityPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Update5GsecurityPolicy403Example:
                  summary: Default update5GSecurityPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '404':
          description: Security policy not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Update5GsecurityPolicy404Example:
                  summary: Default update5GSecurityPolicy 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Update5GsecurityPolicy500Example:
                  summary: Default update5GSecurityPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: delete5GSecurityPolicy
      summary: Palo Alto Networks Delete 5G Security Policy
      description: Deletes a 5G security policy.
      tags:
      - Security Policies
      parameters:
      - name: policy_id
        in: path
        required: true
        description: Unique identifier of the security policy to delete.
        schema:
          type: string
        example: '610878'
      responses:
        '204':
          description: Security policy deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Delete5GsecurityPolicy401Example:
                  summary: Default delete5GSecurityPolicy 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Delete5GsecurityPolicy403Example:
                  summary: Default delete5GSecurityPolicy 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '404':
          description: Security policy not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Delete5GsecurityPolicy404Example:
                  summary: Default delete5GSecurityPolicy 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Delete5GsecurityPolicy500Example:
                  summary: Default delete5GSecurityPolicy 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
                    request_id: b8969609-ec40-4367-a0fc-c65a6696edee
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    SecurityPolicy5G:
      type: object
      properties:
        policy_id:
          type: string
          description: Unique identifier of the security policy.
          example: '663558'
        name:
          type: string
          description: Display name of the security policy.
          example: Staging Policy 94
        description:
          type: string
          description: Description of the policy's purpose.
          example: Alert rule network investigation endpoint traffic rule rule policy blocked.
        threat_prevention:
          type: boolean
          description: Whether threat prevention inspection is enabled.
          example: false
        url_filtering:
          type: boolean
          description: Whether URL filtering is enabled for 5G data traffic.
          example: true
        app_identification:
          type: boolean
          description: Whether application identification is enabled.
          example: false
        decryption:
          type: boolean
          description: Whether SSL/TLS decryption is enabled.
          example: false
        log_forwarding:
          type: boolean
          description: Whether log forwarding is enabled for this policy.
          example: false
        enabled:
          type: boolean
          description: Whether this policy is active.
          example: true
        created_at:
          type: string
          format: date-time
          example: '2026-04-11T03:07:30Z'
        updated_at:
          type: string
          format: date-time
          example: '2025-02-26T20:56:47Z'
    SecurityPolicy5GRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          description: Display name for the security policy.
          example: Staging Firewall 55
        description:
          type: string
          description: Optional description.
          example: Suspicious activity violation suspicious alert investigation policy applied incident investigation.
        threat_prevention:
          type: boolean
          default: true
          example: true
        url_filtering:
          type: boolean
          default: false
          example: false
        app_identification:
          type: boolean
          default: true
          example: true
        decryption:
          type: boolean
          default: false
          example: false
        log_forwarding:
          type: boolean
          default: true
          example: true
        enabled:
          type: boolean
          default: true
          example: true
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Applied blocked incident traffic network applied threat traffic incident alert traffic network.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: b8969609-ec40-4367-a0fc-c65a6696edee
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.