Palo Alto Networks Sse API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Sse API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Sse
paths:
  /sse/config/v1/services:
    get:
      operationId: listServices
      summary: Palo Alto Networks List Service Objects
      description: Returns a paginated list of service objects in the specified scope. Service objects define TCP or UDP protocol and port combinations used in security policy rules.
      tags:
      - Sse
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: name
        in: query
        description: Filter by service object name.
        schema:
          type: string
        example: Branch Sensor 70
      responses:
        '200':
          description: Service objects returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceList'
              examples:
                ListServices200Example:
                  summary: Default listServices 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
                      name: Branch Sensor 76
                      folder: example-folder
                      protocol: &id001
                        tcp:
                          port: example-port
                          source_port: example-source_port
                        udp:
                          port: example-port
                          source_port: example-source_port
                      description: Endpoint threat threat activity malware suspicious Security.
                      tag: &id002
                      - pci-scope
                      - critical-asset
                    - id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
                      name: Branch Sensor 76
                      folder: example-folder
                      protocol: *id001
                      description: Endpoint threat threat activity malware suspicious Security.
                      tag: *id002
                    offset: 54
                    total: 212
                    limit: 593
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createService
      summary: Palo Alto Networks Create Service Object
      description: Creates a new service object defining a TCP or UDP protocol with destination port or port range.
      tags:
      - Sse
      parameters:
      - $ref: '#/components/parameters/folder'
      - $ref: '#/components/parameters/snippet'
      - $ref: '#/components/parameters/device'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceRequest'
            examples:
              CreateServiceRequestExample:
                summary: Default createService request
                x-microcks-default: true
                value:
                  name: Primary Firewall 91
                  protocol:
                    tcp:
                      port: example-port
                      source_port: example-source_port
                    udp:
                      port: example-port
                      source_port: example-source_port
                  description: Configured blocked malware violation on malware on threat.
                  tag:
                  - critical-asset
      responses:
        '201':
          description: Service object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Service'
              examples:
                CreateService201Example:
                  summary: Default createService 201 response
                  x-microcks-default: true
                  value:
                    id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
                    name: Branch Sensor 76
                    folder: example-folder
                    protocol:
                      tcp:
                        port: example-port
                        source_port: example-source_port
                      udp:
                        port: example-port
                        source_port: example-source_port
                    description: Endpoint threat threat activity malware suspicious Security.
                    tag:
                    - pci-scope
                    - critical-asset
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sse/config/v1/services/{id}:
    get:
      operationId: getService
      summary: Palo Alto Networks Get Service Object
      description: Returns a single service object by its unique identifier.
      tags:
      - Sse
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: Service object returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Service'
              examples:
                GetService200Example:
                  summary: Default getService 200 response
                  x-microcks-default: true
                  value:
                    id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
                    name: Branch Sensor 76
                    folder: example-folder
                    protocol:
                      tcp:
                        port: example-port
                        source_port: example-source_port
                      udp:
                        port: example-port
                        source_port: example-source_port
                    description: Endpoint threat threat activity malware suspicious Security.
                    tag:
                    - pci-scope
                    - critical-asset
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateService
      summary: Palo Alto Networks Update Service Object
      description: Updates an existing service object by its unique identifier.
      tags:
      - Sse
      parameters:
      - $ref: '#/components/parameters/id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceRequest'
            examples:
              UpdateServiceRequestExample:
                summary: Default updateService request
                x-microcks-default: true
                value:
                  name: Primary Firewall 91
                  protocol:
                    tcp:
                      port: example-port
                      source_port: example-source_port
                    udp:
                      port: example-port
                      source_port: example-source_port
                  description: Configured blocked malware violation on malware on threat.
                  tag:
                  - critical-asset
      responses:
        '200':
          description: Service object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Service'
              examples:
                UpdateService200Example:
                  summary: Default updateService 200 response
                  x-microcks-default: true
                  value:
                    id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
                    name: Branch Sensor 76
                    folder: example-folder
                    protocol:
                      tcp:
                        port: example-port
                        source_port: example-source_port
                      udp:
                        port: example-port
                        source_port: example-source_port
                    description: Endpoint threat threat activity malware suspicious Security.
                    tag:
                    - pci-scope
                    - critical-asset
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteService
      summary: Palo Alto Networks Delete Service Object
      description: Deletes a service object by its unique identifier.
      tags:
      - Sse
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: Service object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteResponse'
              examples:
                DeleteService200Example:
                  summary: Default deleteService 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  parameters:
    id:
      name: id
      in: path
      required: true
      description: Unique identifier of the resource.
      schema:
        type: string
        format: uuid
    snippet:
      name: snippet
      in: query
      description: Configuration snippet name.
      schema:
        type: string
    folder:
      name: folder
      in: query
      description: Configuration folder scope (e.g., Shared, Mobile Users, Remote Networks, Service Connections).
      schema:
        type: string
    offset:
      name: offset
      in: query
      description: Pagination offset (number of records to skip).
      schema:
        type: integer
        default: 0
    device:
      name: device
      in: query
      description: Device name for device-scoped configuration.
      schema:
        type: string
    limit:
      name: limit
      in: query
      description: Maximum number of results per page.
      schema:
        type: integer
        default: 200
        maximum: 5000
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or the resource cannot be modified due to existing references.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Service:
      type: object
      description: A service object defining a protocol and port combination for use in security policy rules.
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
        name:
          type: string
          example: Branch Sensor 76
        folder:
          type: string
          readOnly: true
          example: example-folder
        protocol:
          type: object
          properties:
            tcp:
              type: object
              properties:
                port:
                  type: string
                  description: TCP destination port or range (e.g., 80, 8080-8090).
                  example: example-port
                source_port:
                  type: string
                  example: example-source_port
              example:
                port: example-port
                source_port: example-source_port
            udp:
              type: object
              properties:
                port:
                  type: string
                  description: UDP destination port or range (e.g., 53).
                  example: example-port
                source_port:
                  type: string
                  example: example-source_port
              example:
                port: example-port
                source_port: example-source_port
          example:
            tcp:
              port: example-port
              source_port: example-source_port
            udp:
              port: example-port
              source_port: example-source_port
        description:
          type: string
          example: Endpoint threat threat activity malware suspicious Security.
        tag:
          type: array
          items:
            type: string
          example:
          - pci-scope
          - critical-asset
    ServiceList:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Service'
          example:
          - id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
            name: Branch Sensor 76
            folder: example-folder
            protocol: &id003
              tcp:
                port: example-port
                source_port: example-source_port
              udp:
                port: example-port
                source_port: example-source_port
            description: Endpoint threat threat activity malware suspicious Security.
            tag: &id004
            - pci-scope
            - critical-asset
          - id: f1e1fe13-6c3a-4dea-b1dc-e44892e05494
            name: Branch Sensor 76
            folder: example-folder
            protocol: *id003
            description: Endpoint threat threat activity malware suspicious Security.
            tag: *id004
        offset:
          type: integer
          example: 54
        total:
          type: integer
          example: 212
        limit:
          type: integer
          example: 593
    DeleteResponse:
      type: object
      properties:
        id:
          type: string
          description: Identifier of the deleted resource.
          example: example-id
    ServiceRequest:
      type: object
      required:
      - name
      - protocol
      properties:
        name:
          type: string
          example: Primary Firewall 91
        protocol:
          type: object
          properties:
            tcp:
              type: object
              properties:
                port:
                  type: string
                  example: example-port
                source_port:
                  type: string
                  example: example-source_port
              example:
                port: example-port
                source_port: example-source_port
            udp:
              type: object
              properties:
                port:
                  type: string
                  example: example-port
                source_port:
                  type: string
                  example: example-source_port
              example:
                port: example-port
                source_port: example-source_port
          example:
            tcp:
              port: example-port
              source_port: example-source_port
            udp:
              port: example-port
              source_port: example-source_port
        description:
          type: string
          example: Configured blocked malware violation on malware on threat.
        tag:
          type: array
          items:
            type: string
          example:
          - critical-asset
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security monitoring rule configured endpoint on network blocked.
            details: {}
          - code: example-code
            message: Security on on threat monitoring activity policy.
            details: {}
        _request_id:
          type: string
          description: Unique request identifier for troubleshooting.
          example: '574499'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.