Palo Alto Networks SecurityRules API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend SecurityRules API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: SecurityRules
  description: Security rules within rule stacks.
paths:
  /config/rulestacks/{rulestack}/security-rules:
    get:
      operationId: listSecurityRules
      summary: Palo Alto Networks List Security Rules
      description: Returns all security rules in the specified rule stack. Security rules are evaluated in priority order and define traffic inspection and forwarding policy for the Cloud NGFW.
      tags:
      - SecurityRules
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - name: maxresults
        in: query
        description: Maximum number of rules to return.
        schema:
          type: integer
          default: 100
        example: 100
      - name: nexttoken
        in: query
        description: Pagination token from a previous response.
        schema:
          type: string
        example: example-nexttoken
      - name: listtype
        in: query
        description: Whether to return candidate or running configuration.
        schema:
          type: string
          enum:
          - CANDIDATE
          - RUNNING
          default: CANDIDATE
        example: CANDIDATE
      responses:
        '200':
          description: Security rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      RuleListCandidate:
                        type: array
                        items:
                          $ref: '#/components/schemas/SecurityRuleSummary'
                      NextToken:
                        type: string
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListSecurityRules200Example:
                  summary: Default listSecurityRules 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      RuleListCandidate:
                      - Priority: 234
                        RuleName: Production Policy 12
                        Enabled: false
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSecurityRule
      summary: Palo Alto Networks Create Security Rule
      description: Creates a new security rule in the rule stack at the specified priority. Rules with lower priority numbers are evaluated first. Define source and destination criteria, applications, and the enforcement action.
      tags:
      - SecurityRules
      parameters:
      - $ref: '#/components/parameters/rulestack'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityRuleRequest'
            examples:
              CreateSecurityRuleRequestExample:
                summary: Default createSecurityRule request
                x-microcks-default: true
                value:
                  Priority: 48316
                  RuleEntry:
                    RuleName: Primary Gateway 01
                    Description: Activity Security blocked suspicious threat alert activity firewall.
                    Enabled: true
                    Source:
                      Cidrs:
                      - example-Cidrs_item
                      Countries:
                      - example-Countries_item
                      Feeds:
                      - example-Feeds_item
                      - example-Feeds_item
                      PrefixLists:
                      - example-PrefixLists_item
                      - example-PrefixLists_item
                    Destination:
                      Cidrs:
                      - example-Cidrs_item
                      - example-Cidrs_item
                      Countries:
                      - example-Countries_item
                      - example-Countries_item
                      Feeds:
                      - example-Feeds_item
                      FqdnLists:
                      - example-FqdnLists_item
                      - example-FqdnLists_item
                      PrefixLists:
                      - example-PrefixLists_item
                    Applications:
                    - ssh
                    Protocol: APPLICATION-DEFAULT
                    Action: DenySilent
      responses:
        '200':
          description: Security rule created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/SecurityRule'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateSecurityRule200Example:
                  summary: Default createSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      Priority: 707
                      RuleEntry:
                        RuleName: Primary Gateway 01
                        Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring.
                        Enabled: true
                        Source:
                          Cidrs:
                          - example-Cidrs_item
                          - example-Cidrs_item
                          Countries:
                          - example-Countries_item
                          - example-Countries_item
                          Feeds:
                          - example-Feeds_item
                          PrefixLists:
                          - example-PrefixLists_item
                        NegateSource: false
                        Destination:
                          Cidrs:
                          - example-Cidrs_item
                          Countries:
                          - example-Countries_item
                          - example-Countries_item
                          Feeds:
                          - example-Feeds_item
                          FqdnLists:
                          - example-FqdnLists_item
                          - example-FqdnLists_item
                          PrefixLists:
                          - example-PrefixLists_item
                        NegateDestination: false
                        Applications:
                        - dns
                        - web-browsing
                        Category:
                          URLCategoryNames:
                          - Production Sensor 06
                          Feeds:
                          - example-Feeds_item
                        Protocol: UDP
                        Action: Allow
                        DecryptionRuleType: SSLOutboundInspection
                        AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied.
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /config/rulestacks/{rulestack}/security-rules/{priority}:
    get:
      operationId: getSecurityRule
      summary: Palo Alto Networks Get Security Rule
      description: Returns a specific security rule by its priority number within the rule stack.
      tags:
      - SecurityRules
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - $ref: '#/components/parameters/priority'
      - name: candidate
        in: query
        description: Return candidate configuration if true, running configuration if false.
        schema:
          type: boolean
          default: true
        example: true
      responses:
        '200':
          description: Security rule returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/SecurityRule'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                GetSecurityRule200Example:
                  summary: Default getSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      Priority: 707
                      RuleEntry:
                        RuleName: Primary Gateway 01
                        Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring.
                        Enabled: true
                        Source:
                          Cidrs:
                          - example-Cidrs_item
                          - example-Cidrs_item
                          Countries:
                          - example-Countries_item
                          - example-Countries_item
                          Feeds:
                          - example-Feeds_item
                          PrefixLists:
                          - example-PrefixLists_item
                        NegateSource: false
                        Destination:
                          Cidrs:
                          - example-Cidrs_item
                          Countries:
                          - example-Countries_item
                          - example-Countries_item
                          Feeds:
                          - example-Feeds_item
                          FqdnLists:
                          - example-FqdnLists_item
                          - example-FqdnLists_item
                          PrefixLists:
                          - example-PrefixLists_item
                        NegateDestination: false
                        Applications:
                        - dns
                        - web-browsing
                        Category:
                          URLCategoryNames:
                          - Production Sensor 06
                          Feeds:
                          - example-Feeds_item
                        Protocol: UDP
                        Action: Allow
                        DecryptionRuleType: SSLOutboundInspection
                        AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied.
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateSecurityRule
      summary: Palo Alto Networks Update Security Rule
      description: Updates an existing security rule at the specified priority in the rule stack.
      tags:
      - SecurityRules
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - $ref: '#/components/parameters/priority'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityRuleRequest'
            examples:
              UpdateSecurityRuleRequestExample:
                summary: Default updateSecurityRule request
                x-microcks-default: true
                value:
                  Priority: 48316
                  RuleEntry:
                    RuleName: Primary Gateway 01
                    Description: Activity Security blocked suspicious threat alert activity firewall.
                    Enabled: true
                    Source:
                      Cidrs:
                      - example-Cidrs_item
                      Countries:
                      - example-Countries_item
                      Feeds:
                      - example-Feeds_item
                      - example-Feeds_item
                      PrefixLists:
                      - example-PrefixLists_item
                      - example-PrefixLists_item
                    Destination:
                      Cidrs:
                      - example-Cidrs_item
                      - example-Cidrs_item
                      Countries:
                      - example-Countries_item
                      - example-Countries_item
                      Feeds:
                      - example-Feeds_item
                      FqdnLists:
                      - example-FqdnLists_item
                      - example-FqdnLists_item
                      PrefixLists:
                      - example-PrefixLists_item
                    Applications:
                    - ssh
                    Protocol: APPLICATION-DEFAULT
                    Action: DenySilent
      responses:
        '200':
          description: Security rule updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/SecurityRule'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                UpdateSecurityRule200Example:
                  summary: Default updateSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      Priority: 707
                      RuleEntry:
                        RuleName: Primary Gateway 01
                        Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring.
                        Enabled: true
                        Source:
                          Cidrs:
                          - example-Cidrs_item
                          - example-Cidrs_item
                          Countries:
                          - example-Countries_item
                          - example-Countries_item
                          Feeds:
                          - example-Feeds_item
                          PrefixLists:
                          - example-PrefixLists_item
                        NegateSource: false
                        Destination:
                          Cidrs:
                          - example-Cidrs_item
                          Countries:
                          - example-Countries_item
                          - example-Countries_item
                          Feeds:
                          - example-Feeds_item
                          FqdnLists:
                          - example-FqdnLists_item
                          - example-FqdnLists_item
                          PrefixLists:
                          - example-PrefixLists_item
                        NegateDestination: false
                        Applications:
                        - dns
                        - web-browsing
                        Category:
                          URLCategoryNames:
                          - Production Sensor 06
                          Feeds:
                          - example-Feeds_item
                        Protocol: UDP
                        Action: Allow
                        DecryptionRuleType: SSLOutboundInspection
                        AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied.
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteSecurityRule
      summary: Palo Alto Networks Delete Security Rule
      description: Deletes the security rule at the specified priority from the rule stack.
      tags:
      - SecurityRules
      parameters:
      - $ref: '#/components/parameters/rulestack'
      - $ref: '#/components/parameters/priority'
      responses:
        '200':
          description: Security rule deleted successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                DeleteSecurityRule200Example:
                  summary: Default deleteSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /security-rules:
    get:
      operationId: listSecurityRules
      summary: Palo Alto Networks List Security Rules
      description: Returns a list of security policy rules configured in Prisma Access. Security rules control traffic flowing through the SASE platform by specifying source, destination, application, and action criteria. Rules are evaluated in order from top to bottom.
      tags:
      - SecurityRules
      parameters:
      - name: folder
        in: query
        required: true
        description: The folder containing the security rules (e.g., Shared, Mobile Users, Remote Networks).
        schema:
          type: string
        example: example-folder
      - name: position
        in: query
        description: Filter by rule position (pre or post).
        schema:
          type: string
          enum:
          - pre
          - post
        example: pre
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 200
        example: 200
      responses:
        '200':
          description: Security rules returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SecurityRule_2'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListSecurityRules200Example:
                  summary: Default listSecurityRules 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Branch Policy 74
                      description: Security incident incident threat violation malware.
                      disabled: false
                      from: &id001
                      - example-from_item
                      to: &id002
                      - example-to_item
                      source: &id003
                      - example-source_item
                      - example-source_item
                      destination: &id004
                      - example-destination_item
                      source_user: &id005
                      - example-source_user_item
                      application: &id006
                      - ssl
                      - dns
                      service: &id007
                      - example-service_item
                      category: &id008
                      - custom
                      action: drop
                      profile_setting: &id009
                        group:
                        - example-group_item
                      log_setting: example-log_setting
                      tag: &id010
                      - production
                      - critical-asset
                      folder: example-folder
                      position: pre
                    - id: example-id
                      name: Branch Policy 74
                      description: Security incident incident threat violation malware.
                      disabled: false
                      from: *id001
                      to: *id002
                      source: *id003
                      destination: *id004
                      source_user: *id005
                      application: *id006
                      service: *id007
                      category: *id008
                      action: drop
                      profile_setting: *id009
                      log_setting: example-log_setting
                      tag: *id010
                      folder: example-folder
                      position: pre
                    offset: 526
                    total: 263
                    limit: 721
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createSecurityRule
      summary: Palo Alto Networks Create a Security Rule
      description: Creates a new security rule in the candidate configuration. Changes must be pushed to take effect.
      tags:
      - SecurityRules
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the security rule.
        schema:
          type: string
        example: example-folder
      - name: position
        in: query
        description: Position for the new rule (pre or post).
        schema:
          type: string
          enum:
          - pre
          - post
        example: pre
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityRule_2'
            examples:
              CreateSecurityRuleRequestExample:
                summary: Default createSecurityRule request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Policy 74
                  description: Security incident incident threat violation malware.
                  disabled: false
                  from: &id011
                  - example-from_item
                  to: &id012
                  - example-to_item
                  source: &id013
                  - example-source_item
                  - example-source_item
                  destination: &id014
                  - example-destination_item
                  source_user: &id015
                  - example-source_user_item
                  application: &id016
                  - ssl
                  - dns
                  service: &id017
                  - example-service_item
                  category: &id018
                  - custom
                  action: drop
                  profile_setting: &id019
                    group:
                    - example-group_item
                  log_setting: example-log_setting
                  tag: &id020
                  - production
                  - critical-asset
                  folder: example-folder
                  position: pre
      responses:
        '201':
          description: Security rule created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityRule_2'
              examples:
                CreateSecurityRule201Example:
                  summary: Default createSecurityRule 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Policy 74
                    description: Security incident incident threat violation malware.
                    disabled: false
                    from: *id011
                    to: *id012
                    source: *id013
                    destination: *id014
                    source_user: *id015
                    application: *id016
                    service: *id017
                    category: *id018
                    action: drop
                    profile_setting: *id019
                    log_setting: example-log_setting
                    tag: *id020
                    folder: example-folder
                    position: pre
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /security-rules/{id}:
    get:
      operationId: getSecurityRule
      summary: Palo Alto Networks Get a Security Rule
      description: Returns the configuration of a specific security rule.
      tags:
      - SecurityRules
      parameters:
      - name: id
        in: path
        required: true
        description: Unique security rule identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Security rule returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityRule_2'
              examples:
                GetSecurityRule200Example:
                  summary: Default getSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Policy 74
                    description: Security incident incident threat violation malware.
                    disabled: false
                    from:
                    - example-from_item
                    to:
                    - example-to_item
                    source:
                    - example-source_item
                    - example-source_item
                    destination:
                    - example-destination_item
                    source_user:
                    - example-source_user_item
                    application:
                    - ssl
                    - dns
                    service:
                    - example-service_item
                    category:
                    - custom
                    action: drop
                    profile_setting:
                      group:
                      - example-group_item
                    log_setting: example-log_setting
                    tag:
                    - production
                    - critical-asset
                    folder: example-folder
                    position: pre
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateSecurityRule
      summary: Palo Alto Networks Update a Security Rule
      description: Updates an existing security rule in the candidate configuration.
      tags:
      - SecurityRules
      parameters:
      - name: id
        in: path
        required: true
        description: Unique security rule identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityRule_2'
            examples:
              UpdateSecurityRuleRequestExample:
                summary: Default updateSecurityRule request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Policy 74
                  description: Security incident incident threat violation malware.
                  disabled: false
                  from: &id021
                  - example-from_item
                  to: &id022
                  - example-to_item
                  source: &id023
                  - example-source_item
                  - example-source_item
                  destination: &id024
                  - example-destination_item
                  source_user: &id025
                  - example-source_user_item
                  application: &id026
                  - ssl
                  - dns
                  service: &id027
                  - example-service_item
                  category: &id028
                  - custom
                  action: drop
                  profile_setting: &id029
                    group:
                    - example-group_item
                  log_setting: example-log_setting
                  tag: &id030
                  - production
                  - critical-asset
                  folder: example-folder
                  position: pre
      responses:
        '200':
          description: Security rule updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityRule_2'
              examples:
                UpdateSecurityRule200Example:
                  summary: Default updateSecurityRule 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Policy 74
                    description: Security incident incident threat violation malware.
                    disabled: false
                    from: *id021
                    to: *id022
                    source: *id023
                    destination: *id024
                    source_user: *id025
                    application: *id026
                    service: *id027
                    category: *id028
                    action: drop
                    profile_setting: *id029
                    log_setting: example-log_setting
                    tag: *id030
                    folder: example-folder
                    position: pre
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'


# --- truncated at 32 KB (74 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-securityrules-api-openapi.yml