Palo Alto Networks Vlan Attachment API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Vlan Attachment API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Vlan Attachment
paths:
  /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments:
    get:
      tags:
      - Vlan Attachment
      summary: Palo Alto Networks List Vlan Attachments
      description: Retrieve all virtual circuits configured within a specific Interconnect. This allows administrators to verify the regional distribution of attachments and their current BGP states. Use this when auditing high-availability (HA) domains or verifying pairing key availability. The response lists BGP parameters, edge availability domains, and current provisioning states for each circuit.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '400911'
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Get vlan attachments in an interconnect:
                  value:
                    data:
                    - bfdEnabled: false
                      bgpPeerAsn: 16363
                      bgpPeerBfdSessionInitMode: DISABLED
                      bgpPeerMd5AuthEnabled: false
                      createTime: 1758575564100
                      edgeAvailability: AVAILABILITY_DOMAIN_2
                      id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b
                      name: test-2
                      permittedActions: []
                      stackType: IPV4_ONLY
                      state: NOT_STARTED
                      status: INACTIVE
                      tenantCount: 0
                      updateTime: 1758575564106
                    - bfdEnabled: false
                      bgpPeerAsn: 16363
                      bgpPeerBfdSessionInitMode: DISABLED
                      bgpPeerMd5AuthEnabled: false
                      createTime: 1758575564075
                      edgeAvailability: AVAILABILITY_DOMAIN_1
                      id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e
                      name: test-1
                      permittedActions: []
                      stackType: IPV4_ONLY
                      state: NOT_STARTED
                      status: INACTIVE
                      tenantCount: 0
                      updateTime: 1758575564082
                    requestId: 21f951d8-0d34-48cb-ae3e-29fcc5339bea
        '400':
          description: Bad Request
        '500':
          description: Server Error
      operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachments
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      tags:
      - Vlan Attachment
      summary: Palo Alto Networks Provision Vlan Attachment
      description: Create a new virtual circuit, known as a VlanAttachment, within an Interconnect to enable data transfer. This establishes the actual logical path for Prisma Access traffic routing through the Service Provider. Deploy this when initializing new egress paths or adding redundant links for regional reliability. Required parameters include a unique name, BGP Peer ASN, and BFD initialization mode to ensure robust connectivity.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '122475'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VlanAttachmentRequest'
            examples:
              Create Partner VLAN attachment:
                value:
                  name: test
                  bgpPeerAsn: 16550
                  bgpPeerBfdSessionInitMode: DISABLED
                  stackType: IPV4_ONLY
                  bgpPeerMd5AuthEnabled: false
              Create VLAN attachment with BFD enabled:
                value:
                  name: bfd-conn
                  bgpPeerAsn: 65001
                  bgpPeerBfdSessionInitMode: ACTIVE
                  bgpPeerBfdMinTransmitInterval: 1000
                  bgpPeerBfdMinReceiveInterval: 1000
                  bgpPeerBfdMultiplier: 5
                  stackType: IPV4_ONLY
                  bgpPeerMd5AuthEnabled: true
              Create VLAN attachment with IPv4/IPv6:
                value:
                  name: dual-stack
                  bgpPeerAsn: 64512
                  bgpPeerBfdSessionInitMode: PASSIVE
                  stackType: IPV4_IPV6
                  bgpPeerMd5AuthEnabled: false
              Create Dedicated VLAN attachment:
                value:
                  name: ded-vlan
                  bgpPeerAsn: 16363
                  bgpPeerBfdSessionInitMode: ACTIVE
                  bandwidth: BPS_10G
                  stackType: IPV4_ONLY
                  bgpPeerMd5AuthEnabled: true
                  dedicatedConnectionDetails:
                  - edgeAvailability: ZONE1
                    bandwidth: BPS_10G
                  - edgeAvailability: ZONE2
                    bandwidth: BPS_10G
              Create VLAN attachment with custom IP addresses:
                value:
                  name: custom-ip-vlan
                  bgpPeerAsn: 65001
                  bgpPeerBfdSessionInitMode: ACTIVE
                  stackType: IPV4_ONLY
                  bgpPeerMd5AuthEnabled: false
                  primaryAttachmentCustomIpAddress:
                    candidateCloudRouterIpAddress: 169.254.1.1/29
                    candidateCustomerRouterIpAddress: 169.254.1.2/29
                  redundantAttachmentCustomIpAddress:
                    candidateCloudRouterIpAddress: 169.254.2.1/29
                    candidateCustomerRouterIpAddress: 169.254.2.2/29
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              examples:
                Add vlan attachment in interconnect:
                  value:
                    data:
                    - bfdEnabled: false
                      bgpPeerAsn: 16363
                      bgpPeerBfdSessionInitMode: DISABLED
                      bgpPeerMd5AuthEnabled: false
                      createTime: 1758575564075
                      edgeAvailability: AVAILABILITY_DOMAIN_1
                      id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e
                      name: test-1
                      permittedActions: []
                      stackType: IPV4_ONLY
                      state: NOT_STARTED
                      status: INACTIVE
                      tenantCount: 0
                      updateTime: 1758575564077
                    - bfdEnabled: false
                      bgpPeerAsn: 16363
                      bgpPeerBfdSessionInitMode: DISABLED
                      bgpPeerMd5AuthEnabled: false
                      createTime: 1758575564100
                      edgeAvailability: AVAILABILITY_DOMAIN_2
                      id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b
                      name: test-2
                      permittedActions: []
                      stackType: IPV4_ONLY
                      state: NOT_STARTED
                      status: INACTIVE
                      tenantCount: 0
                      updateTime: 1758575564101
                    requestId: 73811958-f1a9-4a3e-b5f1-b9373eeb4000
                Add vlan attachment with custom IP addresses:
                  value:
                    data:
                    - bfdEnabled: false
                      bgpPeerAsn: 65001
                      bgpPeerBfdSessionInitMode: ACTIVE
                      bgpPeerMd5AuthEnabled: false
                      createTime: 1758575564075
                      edgeAvailability: AVAILABILITY_DOMAIN_1
                      id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e
                      name: custom-ip-vlan-1
                      permittedActions: []
                      stackType: IPV4_ONLY
                      state: NOT_STARTED
                      status: INACTIVE
                      tenantCount: 0
                      updateTime: 1758575564077
                      customIpAddress:
                        candidateCloudRouterIpAddress: 169.254.1.1/29
                        candidateCustomerRouterIpAddress: 169.254.1.2/29
                    - bfdEnabled: false
                      bgpPeerAsn: 65001
                      bgpPeerBfdSessionInitMode: ACTIVE
                      bgpPeerMd5AuthEnabled: false
                      createTime: 1758575564100
                      edgeAvailability: AVAILABILITY_DOMAIN_2
                      id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b
                      name: custom-ip-vlan-2
                      permittedActions: []
                      stackType: IPV4_ONLY
                      state: NOT_STARTED
                      status: INACTIVE
                      tenantCount: 0
                      updateTime: 1758575564101
                      customIpAddress:
                        candidateCloudRouterIpAddress: 169.254.2.1/29
                        candidateCustomerRouterIpAddress: 169.254.2.2/29
                    requestId: 73811958-f1a9-4a3e-b5f1-b9373eeb4000
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                Add vlan attachment, interconnect not found:
                  value:
                    error:
                      errorCode: 52008
                      errorType: VALIDATION_ERROR
                      httpStatus: 404
                      msg: Interconnect not found
                    requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b
        '400':
          description: Bad Request
          content:
            application/json:
              examples:
                VLAN attachment name exists:
                  value:
                    error:
                      errorCode: 52011
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Connection name already exists
                    requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
                Max vlan attachments reached:
                  value:
                    error:
                      errorCode: 52018
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Reached maximum number of vlan attachments in an interconnect
                    requestId: b2c3d4e5-6f78-9012-bcde-f12345678901
                Dedicated connection details missing:
                  value:
                    error:
                      errorCode: 52025
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: dedicatedVlanAttachmentDetails cannot be null for Connection with type DEDICATED
                    requestId: c3d4e5f6-7890-1234-cdef-012345678901
                Bandwidth required for dedicated:
                  value:
                    error:
                      errorCode: 52026
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Bandwidth is required input for dedicated VLAN Attachment
                    requestId: d4e5f678-9012-3456-def0-123456789012
                Invalid custom IP addresses:
                  value:
                    error:
                      errorCode: 52027
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Cloud Router IP and Peer IP must both be set or must both be unset. If set, the prefix lengths must be the same, IP addresses must not be in reserved ranges, and must not be network or broadcast addresses.
                    requestId: e6f78901-2345-6789-0123-456789012345
        '500':
          description: Server Error
      operationId: PostMtSp-interconnectInterconnectsBy_interconnectidVlan-attachments
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}:
    get:
      tags:
      - Vlan Attachment
      summary: Palo Alto Networks Get Vlan Attachment
      description: View the full technical specification of a single virtual circuit by its unique identifier. This displays parameters such as MD5 authentication, BGP session timers, and stack type (IPv4/Dual-Stack). Use this to verify pairing key generation or to inspect the specific edge availability domain assigned for redundancy. The returned data provides the exact state needed for alignment with service provider configurations.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '352666'
      - name: vlanAttachmentId
        in: path
        required: true
        schema:
          type: string
        example: '197660'
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Get vlan attachment by Id:
                  value:
                    data:
                      bandwidth: BPS_50M
                      bgpPeerAsn: 16550
                      edgeAvailability: ZONE1
                      id: dee52272-d1e2-4b88-9ebc-a5e70e414d58
                      name: abc-edge-1
                      partnerEmail: sp@mail.com
                      partnerName: sp_abc_name
                      region: us-central1
                      state: CREATED_CONNECTION
                      status: PENDING
                      bgpPeerBfdMinReceiveInterval: 1000
                      bgpPeerBfdMinTransmitInterval: 1000
                      bgpPeerBfdMultiplier: 5
                      bgpPeerMd5AuthEnabled: true
                      requestId: 138de731-25c2-4001-8ea5-d81992c146d7
        '400':
          description: Bad Request
        '500':
          description: Server Error
      operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentid
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      tags:
      - Vlan Attachment
      summary: Palo Alto Networks Delete Vlan Attachment
      description: Permanently remove a specific virtual circuit and its logical configuration from the Interconnect. Terminating these circuits is necessary when network paths are being replaced or retired. Execute this during scheduled maintenance windows or regional re-architecting. Ensure the paired service provider resource is also manually decommissioned to prevent unintended billing.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '106065'
      - name: vlanAttachmentId
        in: path
        required: true
        schema:
          type: string
        example: '238900'
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Delete vlan attachment by Id:
                  value:
                    data: Successfully delete VLAN Attachment
                    requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                Delete vlan attachment, interconnect not found:
                  value:
                    error:
                      errorCode: 52008
                      errorType: VALIDATION_ERROR
                      httpStatus: 404
                      msg: Interconnect not found
                    requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94
        '400':
          description: Bad Request
        '500':
          description: Server Error
      operationId: DeleteMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentid
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}/accept:
    post:
      tags:
      - Vlan Attachment
      summary: Palo Alto Networks Accept AWS Attachment
      description: Transition a pending AWS Direct Connect attachment into the accepted state within the management plane. This serves as the final confirmation required by AWS to activate the virtual circuit. Trigger this action when the circuit state reaches PENDING_SP_ACCEPTANCE in the AWS console. Note that this action is exclusive to AWS deployments and cannot be used for GCP or other providers.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '681643'
      - name: vlanAttachmentId
        in: path
        required: true
        schema:
          type: string
        example: '689952'
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Accept AWS vlan attachment:
                  value:
                    data: Successfully accepted VLAN Attachment
                    requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9
        '400':
          description: Bad Request
          content:
            application/json:
              examples:
                Accept non-AWS vlan attachment:
                  value:
                    error:
                      errorCode: 52047
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Connections created in AWS can be accepted
                    requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b
                Accept vlan attachment not in pending state:
                  value:
                    error:
                      errorCode: 52046
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: VlanAttachment can be accepted only in PENDING_SP_ACCEPTANCE state
                    requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                Interconnect not found:
                  value:
                    error:
                      errorCode: 52008
                      errorType: VALIDATION_ERROR
                      httpStatus: 404
                      msg: Interconnect not found
                    requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94
                Vlan attachment not found:
                  value:
                    error:
                      errorCode: 52029
                      errorType: VALIDATION_ERROR
                      httpStatus: 404
                      msg: Vlan Attachment not found
                    requestId: cf32af05-7df6-4dd2-b27e-7b6ef2683145
        '500':
          description: Server Error
          content:
            application/json:
              examples:
                Accept AWS vlan attachment failed:
                  value:
                    error:
                      errorCode: 52048
                      errorType: INTERNAL_ERROR
                      httpStatus: 500
                      msg: Failed to accept vlan attachment in aws
                    requestId: d42dba1a-23f1-4818-813b-2da9f35c95bb
      operationId: PostMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentidAccept
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}/logs:
    get:
      tags:
      - Vlan Attachment
      summary: Palo Alto Networks Get GCP CloudRouter Logs
      description: Get GCP cloudRouter logs for vlan attachment from startTime to endTime milliseconds.
      parameters:
      - name: interconnectId
        in: path
        required: true
        schema:
          type: string
        example: '362191'
      - name: vlanAttachmentId
        in: path
        required: true
        schema:
          type: string
        example: '633509'
      - name: duration
        in: query
        description: 'Duration for logs. Allowed values: 15m, 1h, 1d, 3d'
        schema:
          type: string
          default: 1d
          enum:
          - 15m
          - 1h
          - 1d
          - 3d
        example: 1d
      responses:
        '200':
          description: Success
          content:
            application/json:
              examples:
                Get cloud router logs:
                  value:
                    data:
                      logs:
                      - timestamp: 1758576695399
                        severity: INFO
                        message: BGP session established with peer 10.0.0.1
                      - timestamp: 1758576779732
                        severity: WARNING
                        message: BGP hold timer expired, resetting session
                    requestId: 82923271-2db3-4895-b1cf-a5faa77d28e3
        '400':
          description: Bad Request
          content:
            application/json:
              examples:
                Invalid duration:
                  value:
                    error:
                      errorCode: 52091
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: Invalid duration, allowed duration are 15m, 1h, 1d, 3d
                    requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b
                Logs not supported for AWS:
                  value:
                    error:
                      errorCode: 52092
                      errorType: VALIDATION_ERROR
                      httpStatus: 400
                      msg: CloudRouter logs supported only for GCP connections
                    requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
        '500':
          description: Server Error
          content:
            application/json:
              examples:
                Failed to get logs:
                  value:
                    error:
                      errorCode: 52090
                      errorType: INTERNAL_ERROR
                      httpStatus: 500
                      msg: Failed getting cloud router logs from GCP
                    requestId: d42dba1a-23f1-4818-813b-2da9f35c95bb
      operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentidLogs
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    VlanAttachmentRequest:
      type: object
      required:
      - name
      - bgpPeerAsn
      - bgpPeerBfdSessionInitMode
      properties:
        name:
          type: string
          pattern: ^([-0-9a-z]){1,13}$
          example: Production Agent 71
        stackType:
          $ref: '#/components/schemas/StackType'
        bandwidth:
          $ref: '#/components/schemas/Bandwidth'
        bgpPeerAsn:
          type: integer
          format: int64
          minimum: 1
          example: 63
        bgpPeerBfdSessionInitMode:
          $ref: '#/components/schemas/SessionInitializationMode'
        bgpPeerBfdMinTransmitInterval:
          type: integer
          format: int64
          maximum: 30000
          minimum: 1000
          example: 10043
        bgpPeerBfdMinReceiveInterval:
          type: integer
          format: int64
          maximum: 30000
          minimum: 1000
          example: 12651
        bgpPeerBfdMultiplier:
          type: integer
          format: int64
          maximum: 16
          minimum: 5
          example: 5
        dedicatedConnectionDetails:
          type: array
          items:
            $ref: '#/components/schemas/DedicatedVlanAttachmentDetailsEntry'
          example:
          - edgeAvailability: example-edgeAvailability
            bandwidth: BPS_300M
          - edgeAvailability: example-edgeAvailability
            bandwidth: BPS_50M
        primaryAttachmentCustomIpAddress:
          $ref: '#/components/schemas/VlanAttachmentCustomIpAddress'
        redundantAttachmentCustomIpAddress:
          $ref: '#/components/schemas/VlanAttachmentCustomIpAddress'
        bgpPeerMd5AuthEnabled:
          type: boolean
          example: true
    SessionInitializationMode:
      type: string
      enum:
      - ACTIVE
      - PASSIVE
      - DISABLED
    StackType:
      type: string
      enum:
      - IPV4_ONLY
      - IPV4_IPV6
    Bandwidth:
      type: string
      enum:
      - BPS_50M
      - BPS_100M
      - BPS_200M
      - BPS_300M
      - BPS_400M
      - BPS_500M
      - BPS_1G
      - BPS_2G
      - BPS_5G
      - BPS_10G
    DedicatedVlanAttachmentDetailsEntry:
      type: object
      properties:
        edgeAvailability:
          type: string
          example: example-edgeAvailability
        bandwidth:
          $ref: '#/components/schemas/Bandwidth'
      required:
      - edgeAvailability
    VlanAttachmentCustomIpAddress:
      type: object
      description: Custom IP address configuration for VLAN attachment BGP peering. Both Cloud Router and Customer Router IP addresses must be provided together with matching prefix lengths (/29 or /30). IP addresses must not be in reserved ranges (RFC1918 private IPs, loopback, etc.) and must not be network or broadcast addresses.
      properties:
        candidateCloudRouterIpAddress:
          type: string
          description: Cloud Router IP address in CIDR notation (e.g., 169.254.1.1/29). Must have prefix length /29 or /30 and match the prefix length of candidateCustomerRouterIpAddress.
          pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))/(29|30)$
          example: 10.163.80.221
        candidateCustomerRouterIpAddress:
          type: string
          description: Customer Router IP address in CIDR notation (e.g., 169.254.1.2/29). Must have prefix length /29 or /30 and match the prefix length of candidateCloudRouterIpAddress.
          pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))/(29|30)$
          example: 10.34.238.244
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.