diff --git a/openapi-specs/scm/config/posture-management/posture-checks.yaml b/openapi-specs/scm/config/posture-management/posture-checks.yaml new file mode 100644 index 000000000..aed3b4d22 --- /dev/null +++ b/openapi-specs/scm/config/posture-management/posture-checks.yaml @@ -0,0 +1,820 @@ +openapi: 3.0.3 +info: + title: Posture Check Upload Initiation API + description: Endpoint to initiate file uploads for posture checks. + version: 1.1.0 + termsOfService: 'https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf' + contact: + email: support@paloaltonetworks.com + name: Palo Alto Networks Technical Support + url: 'https://support.paloaltonetworks.com' + license: + name: MIT + url: https://opensource.org/license/mit +servers: + - url: 'https://api.strata.paloaltonetworks.com/config/deployment/v1' + description: Current + - url: 'https://api.sase.paloaltonetworks.com/sse/config/v1' + description: Legacy +tags: +- name: Config File Upload + description: Config file upload for BPA result +- name: Custom Posture Checks + description: Operations for managing custom posture checks including CRUD and batch operations. + +paths: + /posture/checks/v1/reports/config-file-upload: + post: + tags: + - Config File Upload + summary: Initiate a Config Upload + description: | + Generates a tracking ID and a presigned GCS URL for file upload using device metadata. + + ## Using the Signed URL + + After receiving the `upload_url` in the response, upload your config file using a PUT request: + + ```bash + curl -X PUT "" \ + -H "Content-Type: text/plain" \ + -H "Content-Encoding: gzip" \ + --data-binary @/path/to/your/config.xml + ``` + + **Required headers:** + - `Content-Type: text/plain` + - `Content-Encoding: gzip` + operationId: InitiateConfigUpload + requestBody: + required: true + content: + application/json: + schema: + type: object + required: + - delete_after_processing + properties: + delete_after_processing: + type: boolean + description: If true, the uploaded data will be deleted immediately after processing completes. + default: false + example: false + responses: + '201': + description: Successfully initiated config upload. + headers: + Location: + description: URI of the created task resource. + schema: + type: string + format: uri + example: "/posture/checks/reports/config-file-upload/550e8400-e29b-41d4-a716-446655440000/bpa-result" + content: + application/json: + schema: + type: object + properties: + task_id: + type: string + format: uuid + example: "550e8400-e29b-41d4-a716-446655440000" + upload_url: + type: string + format: uri + description: Presigned GCS URL. + '400': + description: Bad request - missing required header or invalid request body. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '429': + description: Too many requests - maximum limit of 5 active jobs reached. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + /posture/checks/v1/reports/{id}/bpa-result: + get: + tags: + - Config File Upload + summary: Get BPA Processing Status + description: Returns the status (QUEUED, IN_PROGRESS, COMPLETED, FAILED) and final result. + operationId: GetBpaResultByID + parameters: + - in: path + name: id + schema: + type: string + format: uuid + required: true + description: The task ID provided during initiation. + responses: + '200': + description: Status retrieved successfully. + content: + application/json: + schema: + type: object + required: + - status + properties: + status: + type: string + enum: [QUEUED, IN_PROGRESS, COMPLETED, FAILED] + example: "IN_PROGRESS" + message: + type: string + example: "Analyzing security rules..." + result: + type: object + description: Populated only when status is COMPLETED. + properties: + report_url: + type: string + format: uri + '404': + description: Task ID not found. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + /posture/checks/v1/all-checks: + get: + tags: + - Custom Posture Checks + summary: List Posture Checks + description: Returns a paginated list of posture checks (both custom and predefined). + operationId: ListPostureChecks + parameters: + - in: query + name: type + schema: + type: string + enum: [custom, predefined] + description: Filter by check type. + - in: query + name: object_type + schema: + type: string + description: Filter by configuration object type (e.g., "security_rule", "address"). + - in: query + name: severity + schema: + type: string + enum: [Critical, High, Warning, Informational] + description: Filter by severity level. + - in: query + name: management_type + schema: + type: string + enum: [cloud, panorama, ngfw] + description: Filter by management platform. + - in: query + name: limit + schema: + type: integer + minimum: 1 + maximum: 200 + default: 100 + description: Maximum number of results to return. + - in: query + name: offset + schema: + type: integer + minimum: 0 + default: 0 + description: Number of results to skip for pagination. + responses: + '200': + description: List of posture checks. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckListResponse' + '400': + description: Bad request. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + post: + tags: + - Custom Posture Checks + summary: Create Posture Check + description: Creates a new custom posture check. Requires SCM Pro license. + operationId: CreatePostureChecks + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckCreateRequest' + responses: + '201': + description: Posture check created successfully. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheck' + '400': + description: Bad request - validation error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '403': + description: Forbidden - SCM Pro license required. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + /posture/checks/v1/all-checks/{id}: + get: + tags: + - Custom Posture Checks + summary: Get Posture Check + description: Returns a specific posture check by ID. + operationId: GetPostureChecksByID + parameters: + - in: path + name: id + schema: + type: string + required: true + description: The posture check ID. + responses: + '200': + description: Posture check details. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheck' + '404': + description: Posture check not found. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + put: + tags: + - Custom Posture Checks + summary: Update Posture Check + description: Updates an existing custom posture check. Requires SCM Pro license. + operationId: UpdatePostureChecksByID + parameters: + - in: path + name: id + schema: + type: string + required: true + description: The posture check ID. + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckUpdateRequest' + responses: + '200': + description: Posture check updated successfully. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheck' + '400': + description: Bad request - validation error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '403': + description: Forbidden - SCM Pro license required. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '404': + description: Posture check not found. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + delete: + tags: + - Custom Posture Checks + summary: Delete Posture Check + description: Deletes a custom posture check. Requires SCM Pro license. + operationId: DeletePostureChecksByID + parameters: + - in: path + name: id + schema: + type: string + required: true + description: The posture check ID. + responses: + '204': + description: Posture check deleted successfully. + '403': + description: Forbidden - SCM Pro license required. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '404': + description: Posture check not found. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + /posture/checks/v1/all-checks/{id}:clone: + post: + tags: + - Custom Posture Checks + summary: Clone Posture Check + description: Creates a copy of an existing posture check with a new ID. Requires SCM Pro license. + operationId: ClonePostureChecksByID + parameters: + - in: path + name: id + schema: + type: string + required: true + description: The posture check ID to clone. + requestBody: + required: false + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckCloneRequest' + responses: + '201': + description: Posture check cloned successfully. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheck' + '400': + description: Bad request - validation error (e.g., duplicate name). + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '403': + description: Forbidden - SCM Pro license required. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '404': + description: Posture check not found. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + /posture/checks/v1/all-checks/batch-upsert: + post: + tags: + - Custom Posture Checks + summary: Batch Upsert Posture Checks + description: Creates or updates multiple posture checks in a single call. Objects with an existing ID will be updated, new objects will be created. Requires SCM Pro license. + operationId: BatchUpsertPostureChecks + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckBatchUpsertRequest' + responses: + '200': + description: Batch upsert completed. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckBatchUpsertResponse' + '400': + description: Bad request - validation error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '403': + description: Forbidden - SCM Pro license required. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + /posture/checks/v1/all-checks/batch-delete: + post: + tags: + - Custom Posture Checks + summary: Batch Delete Posture Checks + description: Deletes multiple posture checks in a single call. Requires SCM Pro license. + operationId: BatchDeletePostureChecks + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckBatchDeleteRequest' + responses: + '200': + description: Batch delete completed. + content: + application/json: + schema: + $ref: '#/components/schemas/PostureCheckBatchDeleteResponse' + '400': + description: Bad request - validation error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '403': + description: Forbidden - SCM Pro license required. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '500': + description: Internal server error. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + +components: + schemas: + Error: + type: object + properties: + _errors: + type: array + items: + type: object + properties: + code: + type: string + description: The error code representing a specific error condition. + example: "API_I00035" + message: + type: string + description: A brief description of the error condition. + example: "Invalid Request Payload" + details: + type: array + items: + type: string + description: An explanation of the error condition. + example: ["Missing required header: x-tenant-id"] + help: + type: string + format: uri + description: A URL link to documentation describing the error condition. + example: "https://docs.example.com/errors#API_I00035" + _request_id: + type: string + format: uuid + description: The request ID for troubleshooting purposes. + example: "eb18eb0c-d5b7-43f3-9e38-38464ee11e2f" + + PostureCheck: + type: object + required: + - id + - name + - object_type + - type + - severity + properties: + id: + type: string + description: Unique identifier for the posture check. + example: "1001" + name: + type: string + description: Human-readable name of the posture check. + example: "Security Rule has logging enabled" + description: + type: string + description: Detailed description of what the check validates. + rationale: + type: string + description: Explanation of why this check is important. + object_type: + type: string + description: The configuration object type this check applies to. + example: "security_rule" + type: + type: string + enum: [custom, predefined] + description: Whether this is a custom or predefined check. + severity: + type: string + enum: [Critical, High, Warning, Informational] + description: Severity level of the check. + management_type: + type: string + enum: [cloud, panorama, ngfw] + description: Management platform this check applies to. + sub_type: + type: string + description: Sub-category of the check. + action: + type: string + enum: [alert, failCommit] + description: Action to take when check fails. + data: + type: object + additionalProperties: true + description: Check rule definition/expression (custom checks only). + fields_affected: + type: array + items: + type: string + description: List of config fields this check evaluates. + recommendation: + type: string + description: Recommended action for this check. + impact: + type: string + description: Impact description if the check fails. + created_at: + type: string + format: date-time + description: Timestamp when the check was created. + updated_at: + type: string + format: date-time + description: Timestamp when the check was last updated. + + PostureCheckCreateRequest: + type: object + required: + - name + - object_type + - data + - severity + properties: + name: + type: string + description: Human-readable name of the posture check. + description: + type: string + rationale: + type: string + object_type: + type: string + description: The configuration object type this check applies to. + sub_type: + type: string + description: Sub-category of the check. + severity: + type: string + enum: [Critical, High, Warning, Informational] + management_type: + type: string + enum: [cloud, panorama, ngfw] + default: cloud + action: + type: string + enum: [alert, failCommit] + default: alert + data: + type: object + additionalProperties: true + description: Check rule definition/expression. + sub_feature: + type: object + additionalProperties: true + description: Sub-feature configuration for rule-specific checks. + + PostureCheckUpdateRequest: + type: object + required: + - name + - object_type + - data + - severity + properties: + name: + type: string + description: + type: string + rationale: + type: string + object_type: + type: string + sub_type: + type: string + severity: + type: string + enum: [Critical, High, Warning, Informational] + management_type: + type: string + enum: [cloud, panorama, ngfw] + action: + type: string + enum: [alert, failCommit] + data: + type: object + additionalProperties: true + sub_feature: + type: object + additionalProperties: true + + PostureCheckCloneRequest: + type: object + properties: + name: + type: string + description: Optional new name for the cloned check. Defaults to "{original_name} (Copy)". + maxLength: 256 + + PostureCheckBatchUpsertRequest: + type: object + required: + - checks + properties: + checks: + type: array + items: + $ref: '#/components/schemas/PostureCheckUpsertItem' + minItems: 1 + maxItems: 100 + description: Array of posture checks to create or update. + + PostureCheckUpsertItem: + type: object + required: + - name + - object_type + - data + - severity + properties: + id: + type: string + description: If provided, the check will be updated. If omitted, a new check will be created. + name: + type: string + description: + type: string + rationale: + type: string + object_type: + type: string + sub_type: + type: string + severity: + type: string + enum: [Critical, High, Warning, Informational] + management_type: + type: string + enum: [cloud, panorama, ngfw] + default: cloud + action: + type: string + enum: [alert, failCommit] + default: alert + data: + type: object + additionalProperties: true + fields_affected: + type: array + items: + type: string + sub_feature: + type: object + additionalProperties: true + + PostureCheckBatchUpsertResponse: + type: object + properties: + created: + type: array + items: + $ref: '#/components/schemas/PostureCheck' + description: List of newly created posture checks. + updated: + type: array + items: + $ref: '#/components/schemas/PostureCheck' + description: List of updated posture checks. + errors: + type: array + items: + $ref: '#/components/schemas/BatchOperationError' + description: List of errors for checks that failed to create/update. + + PostureCheckBatchDeleteRequest: + type: object + required: + - ids + properties: + ids: + type: array + items: + type: string + minItems: 1 + maxItems: 100 + description: Array of posture check IDs to delete. + + PostureCheckBatchDeleteResponse: + type: object + properties: + deleted: + type: array + items: + type: string + description: List of successfully deleted posture check IDs. + errors: + type: array + items: + $ref: '#/components/schemas/BatchOperationError' + description: List of errors for checks that failed to delete. + + BatchOperationError: + type: object + properties: + id: + type: string + description: The ID or index of the item that failed. + message: + type: string + description: Error message describing why the operation failed. + + PostureCheckListResponse: + type: object + properties: + data: + type: array + items: + $ref: '#/components/schemas/PostureCheck' + total: + type: integer + description: Total number of posture checks matching the query. + limit: + type: integer + description: Maximum number of results returned. + offset: + type: integer + description: Number of results skipped. diff --git a/openapi-specs/scm/config/posture-management/posture.yaml b/openapi-specs/scm/config/posture-management/posture.yaml deleted file mode 100644 index a439f37c0..000000000 --- a/openapi-specs/scm/config/posture-management/posture.yaml +++ /dev/null @@ -1,2347 +0,0 @@ -openapi: 3.0.3 -info: - title: Posture Management API - description: | - This API provides comprehensive posture management capabilities including: - - Custom posture check management (create, update, delete, clone, batch operations) - - Config file upload for BPA (Best Practice Assessment) results - - Config cleanup for identifying unused or redundant configuration objects - - Compliance framework definition management (create, update, delete, release) - - Compliance analytics and reporting - - Benchmark monitoring and BPC (Best Practice Check) verdict tracking - version: 1.1.0 - termsOfService: 'https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf' - contact: - email: support@paloaltonetworks.com - name: Palo Alto Networks Technical Support - url: 'https://support.paloaltonetworks.com' - license: - name: MIT - url: https://opensource.org/license/mit -servers: - - url: 'https://api.strata.paloaltonetworks.com/posture' - description: Current -tags: - - name: Config Upload - description: Config file upload for BPA result. - - name: Checks - description: Operations for managing custom posture checks including CRUD and batch operations. - - name: Config Cleanup - description: Operations for identifying unused or redundant configuration objects. - - name: Compliance Frameworks - description: Operations for managing compliance framework definitions including CRUD, clone, benchmark, and release operations. - - name: Compliance Analytics - description: Analytics and reporting for compliance frameworks including summaries, scores, and timelines. - - name: Benchmark Monitoring - description: Monitoring and reporting for benchmarked compliance frameworks with BPC verdict tracking. - -security: - - BearerAuth: [] - -paths: - # ──── Checks ──── - /checks/v1/reports/config-file-upload: - post: - tags: - - Config Upload - summary: Initiate a Config Upload - description: | - Generates a tracking ID and a presigned GCS URL for file upload using device metadata. - - ## Using the Signed URL - - After receiving the `upload_url` in the response, upload your config file using a PUT request: - - ```bash - curl -X PUT "" \ - -H "Content-Type: text/plain" \ - -H "Content-Encoding: gzip" \ - --data-binary @/path/to/your/config.xml - ``` - - **Required headers:** - - `Content-Type: text/plain` - - `Content-Encoding: gzip` - operationId: InitiateConfigUpload - requestBody: - required: true - content: - application/json: - schema: - type: object - required: - - delete_after_processing - properties: - delete_after_processing: - type: boolean - description: If true, the uploaded data will be deleted immediately after processing completes. - default: false - example: false - responses: - '201': - description: Successfully initiated config upload. - headers: - Location: - description: URI of the created task resource. - schema: - type: string - format: uri-reference - example: "/checks/v1/reports/550e8400-e29b-41d4-a716-446655440000/bpa-result" - content: - application/json: - schema: - type: object - properties: - task_id: - type: string - format: uuid - example: "550e8400-e29b-41d4-a716-446655440000" - upload_url: - type: string - format: uri - description: Presigned GCS URL. - '400': - description: Bad request - missing required header or invalid request body. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '429': - description: Too many requests - maximum limit of 5 active jobs reached. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /checks/v1/reports/{id}/bpa-result: - get: - tags: - - Config Upload - summary: Get BPA Processing Status - description: Returns the status (QUEUED, IN_PROGRESS, COMPLETED, FAILED) and final result. - operationId: GetBpaResultByID - parameters: - - in: path - name: id - schema: - type: string - format: uuid - required: true - description: The task ID provided during initiation. - responses: - '200': - description: Status retrieved successfully. - content: - application/json: - schema: - type: object - required: - - status - properties: - status: - type: string - enum: [QUEUED, IN_PROGRESS, COMPLETED, FAILED] - example: "IN_PROGRESS" - message: - type: string - example: "Analyzing security rules..." - result: - type: object - description: Populated only when status is COMPLETED. - properties: - report_url: - type: string - format: uri - '404': - description: Task ID not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /checks/v1: - get: - tags: - - Checks - summary: List Checks - description: Returns a paginated list of posture checks (both custom and predefined). - operationId: ListPostureChecks - parameters: - - in: query - name: type - schema: - type: string - enum: [custom, predefined] - description: Filter by check type. - - in: query - name: object_type - schema: - type: string - description: Filter by configuration object type (e.g., "security_rule", "address"). - - in: query - name: severity - schema: - type: string - enum: [Critical, High, Warning, Informational] - description: Filter by severity level. - - in: query - name: management_type - schema: - type: string - enum: [cloud, panorama] - description: Filter by management platform. - - in: query - name: limit - schema: - type: integer - minimum: 1 - maximum: 200 - default: 100 - description: Maximum number of results to return. - - in: query - name: offset - schema: - type: integer - minimum: 0 - default: 0 - description: Number of results to skip for pagination. - responses: - '200': - description: List of posture checks. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckListResponse' - '400': - description: Bad request. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - post: - tags: - - Checks - summary: Create Posture Check - description: Creates a new custom posture check. Requires SCM Pro license. - operationId: CreatePostureCheck - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckCreateRequest' - responses: - '201': - description: Posture check created successfully. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheck' - '400': - description: Bad request - validation error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - SCM Pro license required. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /checks/v1/{id}: - get: - tags: - - Checks - summary: Get Posture Check - description: Returns a specific posture check by ID. - operationId: GetPostureCheckByID - parameters: - - in: path - name: id - schema: - type: string - required: true - description: The posture check ID. - responses: - '200': - description: Posture check details. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheck' - '404': - description: Posture check not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - put: - tags: - - Checks - summary: Update Posture Check - description: Updates an existing custom posture check. Requires SCM Pro license. - operationId: UpdatePostureCheckByID - parameters: - - in: path - name: id - schema: - type: string - required: true - description: The posture check ID. - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckUpdateRequest' - responses: - '200': - description: Posture check updated successfully. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheck' - '400': - description: Bad request - validation error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - SCM Pro license required. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Posture check not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - delete: - tags: - - Checks - summary: Delete Posture Check - description: Deletes a custom posture check. Requires SCM Pro license. - operationId: DeletePostureCheckByID - parameters: - - in: path - name: id - schema: - type: string - required: true - description: The posture check ID. - responses: - '204': - description: Posture check deleted successfully. - '403': - description: Forbidden - SCM Pro license required. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Posture check not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /checks/v1/{id}:clone: - post: - tags: - - Checks - summary: Clone Posture Check - description: Creates a copy of an existing posture check with a new ID. Requires SCM Pro license. - operationId: ClonePostureCheckByID - parameters: - - in: path - name: id - schema: - type: string - required: true - description: The posture check ID to clone. - requestBody: - required: false - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckCloneRequest' - responses: - '201': - description: Posture check cloned successfully. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheck' - '400': - description: Bad request - validation error (e.g., duplicate name). - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - SCM Pro license required. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Posture check not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /checks/v1/batch-upsert: - post: - tags: - - Checks - summary: Batch Upsert Checks - description: Creates or updates multiple posture checks in a single call. Objects with an existing ID will be updated, new objects will be created. Requires SCM Pro license. - operationId: BatchUpsertPostureChecks - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckBatchUpsertRequest' - responses: - '200': - description: Batch upsert completed. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckBatchUpsertResponse' - '400': - description: Bad request - validation error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - SCM Pro license required. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /checks/v1/batch-delete: - post: - tags: - - Checks - summary: Batch Delete Checks - description: Deletes multiple posture checks in a single call. Requires SCM Pro license. - operationId: BatchDeletePostureChecks - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckBatchDeleteRequest' - responses: - '200': - description: Batch delete completed. - content: - application/json: - schema: - $ref: '#/components/schemas/PostureCheckBatchDeleteResponse' - '400': - description: Bad request - validation error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - SCM Pro license required. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - # ──── Config Cleanup ──── - /config-cleanup/v1/zerohit-rules: - get: - tags: - - Config Cleanup - summary: Get Zero-Hit Security Rules - description: | - Retrieves security rules that have never been hit (zero traffic matches) for a specified manager. - - Use "SCM" as the manager_hostname to retrieve rules from Strata Cloud Manager. - For Panorama, provide the Panorama hostname. - operationId: GetZeroHitRules - parameters: - - name: manager_hostname - in: query - required: true - schema: - type: string - description: | - Manager hostname to query. Use "SCM" for Strata Cloud Manager, - or the Panorama hostname for Panorama-managed rules. - example: "SCM" - - name: location - in: query - required: false - schema: - type: string - description: Filter by folder (SCM) or device group (Panorama). - - name: limit - in: query - required: false - schema: - type: integer - minimum: 1 - maximum: 200 - default: 200 - description: Maximum number of rules to return. - - name: offset - in: query - required: false - schema: - type: integer - minimum: 0 - default: 0 - description: Number of rules to skip for pagination. - responses: - '200': - description: Zero-hit rules retrieved successfully. - content: - application/json: - schema: - $ref: '#/components/schemas/ZeroHitRulesResponse' - '400': - description: Invalid request parameters (e.g., missing manager_hostname). - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Manager not found or no data available. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - # ──── Compliance Framework Definition ──── - /compliance-frameworks/v1/definitions: - get: - tags: - - Compliance Frameworks - summary: List Compliance Frameworks - description: Retrieve all compliance frameworks for the user's TSG. - operationId: ListComplianceFrameworks - parameters: - - name: category - in: query - required: false - schema: - type: string - enum: - - PCF - - CCF - - all - description: Filter by framework category PCF (Palo Alto Networks) or CCF (Custom). - - name: status - in: query - required: false - schema: - type: string - enum: - - draft - - released - description: Filter by framework status. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFrameworkListResponse' - '400': - description: Bad request - invalid query parameter. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - post: - tags: - - Compliance Frameworks - summary: Create Compliance Framework - description: Create a new compliance framework definition. The server will assign a unique id. - operationId: CreateComplianceFramework - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFrameworkRequest' - responses: - '201': - description: Created successfully. - headers: - Location: - description: URI of the created framework. - schema: - type: string - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFramework' - '400': - description: Bad request - invalid request body or missing required fields. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/definitions/{id}: - get: - tags: - - Compliance Frameworks - summary: Get Framework Revision - description: | - Retrieve details of a compliance framework based on the 'op' query parameter: - - **view_inprogress**: Returns the latest in-progress revision - - **view_inrelease**: Returns the currently released revision - - **view_aggregated**: Returns aggregated framework data - - **view_logo**: Returns the framework's logo - operationId: GetComplianceFramework - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - - name: op - in: query - required: true - schema: - type: string - enum: - - view_inprogress - - view_inrelease - - view_aggregated - - view_logo - description: Operation to perform. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFramework' - '400': - description: Bad request - missing or invalid query parameter. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - put: - tags: - - Compliance Frameworks - summary: Update Compliance Framework - description: | - Update a compliance framework definition. If an in-progress revision exists, it will be updated. If no in-progress revision exists and 'release=false', a new in-progress revision is created. If 'release=true', the framework is both updated and released in a single operation. - operationId: UpdateComplianceFramework - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - - name: release - in: query - required: false - schema: - type: boolean - default: false - description: Whether to release the framework after update. - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFrameworkRequest' - responses: - '200': - description: Successfully updated. - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFramework' - '400': - description: Bad request - invalid request body or validation error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - delete: - tags: - - Compliance Frameworks - summary: Delete Compliance Framework - description: Permanently delete a compliance framework and all its revisions. - operationId: DeleteComplianceFramework - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - responses: - '204': - description: Successfully deleted. - '400': - description: Bad request. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/definitions/{id}:clone: - post: - tags: - - Compliance Frameworks - summary: Clone Compliance Framework - description: Clone the compliance framework to a new one in the user's TSG. - operationId: CloneComplianceFramework - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID to clone. - responses: - '201': - description: Framework cloned successfully. - headers: - Location: - description: URI of the cloned framework. - schema: - type: string - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFramework' - '400': - description: Bad request - invalid framework ID or framework cannot be cloned. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/definitions/{id}:benchmark: - post: - tags: - - Compliance Frameworks - summary: Benchmark Compliance Framework - description: Mark the compliance framework as a benchmark. - operationId: BenchmarkComplianceFramework - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID to benchmark. - responses: - '200': - description: Successfully benchmarked. - content: - application/json: - schema: - type: object - properties: - status: - type: string - example: "success" - '400': - description: Bad request - framework cannot be benchmarked. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/definitions/{id}:un-benchmark: - post: - tags: - - Compliance Frameworks - summary: Remove Framework Benchmark - description: Remove the benchmark designation from the compliance framework. - operationId: UnBenchmarkComplianceFramework - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID to un-benchmark. - responses: - '200': - description: Successfully un-benchmarked. - content: - application/json: - schema: - type: object - properties: - status: - type: string - example: "success" - '400': - description: Bad request - framework cannot be un-benchmarked. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - # ──── Compliance Analytics ──── - /compliance-frameworks/v1/summaries: - get: - tags: - - Compliance Analytics - summary: List Framework Summaries - description: Retrieve summary view of compliance frameworks per current revision, grouped and filtered by product type. - operationId: ListComplianceFrameworkSummaries - parameters: - - name: product - in: query - required: false - schema: - type: string - enum: - - sase - - ngfw - - all - description: Filter by product type. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceFrameworkSummaryResponse' - '400': - description: Bad request - invalid query parameter. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/overall-compliance/{id}: - get: - tags: - - Compliance Analytics - summary: Get Framework Compliance Scores - description: Retrieve overall compliance scores for a framework across different products and categories. - operationId: GetOverallCompliance - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/OverallComplianceResponse' - '400': - description: Bad request. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/overall-compliance-timeline/{id}: - get: - tags: - - Compliance Analytics - summary: Get Compliance Timeline - description: Retrieve compliance score timeline data over 30 days and 1 year. - operationId: GetComplianceTimeline - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - - name: product - in: query - required: false - schema: - type: string - enum: - - sase - - ngfw - - all - description: Product filter. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceTimelineResponse' - '400': - description: Bad request. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/configurations-assessed/{id}: - get: - tags: - - Compliance Analytics - summary: Get Assessed Configurations - description: Retrieve assessed configurations for a compliance framework. - operationId: GetConfigurationsAssessed - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - - name: product - in: query - required: false - schema: - type: string - enum: - - sase - - ngfw - - all - description: Product filter. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/ConfigurationsAssessedResponse' - '400': - description: Bad request. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/compliance-controls/{id}: - get: - tags: - - Compliance Analytics - summary: Get Compliance Controls - description: Retrieve compliance controls for a framework. - operationId: GetComplianceControls - parameters: - - name: id - in: path - required: true - schema: - type: string - description: Compliance framework ID. - - name: product - in: query - required: false - schema: - type: string - enum: - - sase - - ngfw - - all - description: Product filter. - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceControlsResponse' - '400': - description: Bad request. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Compliance framework not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - # ──── Benchmark Monitoring ──── - /compliance-frameworks/v1/benchmark-monitoring: - post: - tags: - - Benchmark Monitoring - summary: Get Benchmark Monitoring Data - description: Retrieve compliance monitoring data for benchmarked frameworks with filtering and pagination. - operationId: GetBenchmarkMonitoring - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/BenchmarkMonitoringRequest' - responses: - '200': - description: Success. - content: - application/json: - schema: - $ref: '#/components/schemas/BenchmarkMonitoringResponse' - '400': - description: Bad request - invalid filter criteria in request body. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance-frameworks/v1/benchmark-monitoring/download: - post: - tags: - - Benchmark Monitoring - summary: Download Benchmark Data - description: Download benchmark monitoring data in specified format (CSV or JSON). - operationId: DownloadBenchmarkMonitoring - parameters: - - name: offset - in: query - required: false - schema: - type: integer - format: int64 - default: 0 - minimum: 0 - description: Number of records to skip for pagination. - - name: limit - in: query - required: false - schema: - type: integer - format: int64 - default: 0 - minimum: 0 - description: Maximum number of records to return (0 for no limit). - - name: format - in: query - required: false - schema: - type: string - default: "csv" - enum: - - csv - - json - description: Export format. - - name: compression - in: query - required: false - schema: - type: string - default: "no" - enum: - - "no" - - gzip - - zip - description: Compression type. - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/BenchmarkMonitoringRequest' - responses: - '200': - description: Success - Returns benchmark monitoring data in the requested format. - content: - application/octet-stream: - schema: - type: string - format: binary - text/csv: - schema: - type: string - format: binary - '400': - description: Bad request - invalid format, compression type, or filter criteria. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '403': - description: Forbidden - insufficient permissions. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '404': - description: Not found. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Internal server error. - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - -components: - securitySchemes: - BearerAuth: - type: http - scheme: bearer - bearerFormat: JWT - description: Bearer token authentication using JWT. - - schemas: - # ──── Common Schemas ──── - Error: - type: object - properties: - _errors: - type: array - items: - type: object - properties: - code: - type: string - description: The error code representing a specific error condition. - message: - type: string - description: A brief description of the error condition. - details: - type: array - items: - type: string - description: An explanation of the error condition. - help: - type: string - format: uri - description: A URL link to documentation describing the error condition. - _request_id: - type: string - format: uuid - description: The request ID for troubleshooting purposes. - - # ──── Posture Check Schemas ──── - PostureCheck: - type: object - required: - - id - - name - - object_type - - type - - severity - properties: - id: - type: string - description: Unique identifier for the posture check. - name: - type: string - description: Human-readable name of the posture check. - description: - type: string - description: Detailed description of what the check validates. - rationale: - type: string - description: Explanation of why this check is important. - object_type: - type: string - description: The configuration object type this check applies to. - type: - type: string - enum: [custom, predefined] - description: Whether this is a custom or predefined check. - severity: - type: string - enum: [Critical, High, Warning, Informational] - description: Severity level of the check. - management_type: - type: string - enum: [cloud, panorama] - description: Management platform this check applies to. - sub_type: - type: string - description: Sub-category of the check. - action: - type: string - enum: [alert, failCommit] - description: Action to take when check fails. - data: - type: object - additionalProperties: true - description: Check rule definition/expression (custom checks only). - fields_affected: - type: array - items: - type: string - description: List of config fields this check evaluates. - recommendation: - type: string - description: Recommended action for this check. - impact: - type: string - description: Impact description if the check fails. - created_at: - type: string - format: date-time - description: Timestamp when the check was created. - updated_at: - type: string - format: date-time - description: Timestamp when the check was last updated. - - PostureCheckCreateRequest: - type: object - required: - - name - - object_type - - data - - severity - properties: - name: - type: string - description: Human-readable name of the posture check. - description: - type: string - rationale: - type: string - object_type: - type: string - description: The configuration object type this check applies to. - sub_type: - type: string - description: Sub-category of the check. - severity: - type: string - enum: [Critical, High, Warning, Informational] - management_type: - type: string - enum: [cloud, panorama] - default: cloud - action: - type: string - enum: [alert, failCommit] - default: alert - data: - type: object - additionalProperties: true - description: Check rule definition/expression. - sub_feature: - type: object - additionalProperties: true - description: Sub-feature configuration for rule-specific checks. - - PostureCheckUpdateRequest: - type: object - required: - - name - - object_type - - data - - severity - properties: - name: - type: string - description: - type: string - rationale: - type: string - object_type: - type: string - sub_type: - type: string - severity: - type: string - enum: [Critical, High, Warning, Informational] - management_type: - type: string - enum: [cloud, panorama] - action: - type: string - enum: [alert, failCommit] - data: - type: object - additionalProperties: true - sub_feature: - type: object - additionalProperties: true - - PostureCheckCloneRequest: - type: object - properties: - name: - type: string - description: Optional new name for the cloned check. - maxLength: 256 - - PostureCheckBatchUpsertRequest: - type: object - required: - - checks - properties: - checks: - type: array - items: - $ref: '#/components/schemas/PostureCheckUpsertItem' - minItems: 1 - maxItems: 100 - description: Array of posture checks to create or update. - - PostureCheckUpsertItem: - type: object - required: - - name - - object_type - - data - - severity - properties: - id: - type: string - description: If provided, the check will be updated. - name: - type: string - description: - type: string - rationale: - type: string - object_type: - type: string - sub_type: - type: string - severity: - type: string - enum: [Critical, High, Warning, Informational] - management_type: - type: string - enum: [cloud, panorama] - default: cloud - action: - type: string - enum: [alert, failCommit] - default: alert - data: - type: object - additionalProperties: true - fields_affected: - type: array - items: - type: string - sub_feature: - type: object - additionalProperties: true - - PostureCheckBatchUpsertResponse: - type: object - properties: - created: - type: array - items: - $ref: '#/components/schemas/PostureCheck' - description: List of newly created posture checks. - updated: - type: array - items: - $ref: '#/components/schemas/PostureCheck' - description: List of updated posture checks. - errors: - type: array - items: - $ref: '#/components/schemas/BatchOperationError' - description: List of errors for checks that failed. - - PostureCheckBatchDeleteRequest: - type: object - required: - - ids - properties: - ids: - type: array - items: - type: string - minItems: 1 - maxItems: 100 - description: Array of posture check IDs to delete. - - PostureCheckBatchDeleteResponse: - type: object - properties: - deleted: - type: array - items: - type: string - description: List of successfully deleted posture check IDs. - errors: - type: array - items: - $ref: '#/components/schemas/BatchOperationError' - description: List of errors for checks that failed to delete. - - BatchOperationError: - type: object - properties: - id: - type: string - description: The ID or index of the item that failed. - message: - type: string - description: Error message describing why the operation failed. - - PostureCheckListResponse: - type: object - properties: - data: - type: array - items: - $ref: '#/components/schemas/PostureCheck' - total: - type: integer - description: Total number of posture checks matching the query. - limit: - type: integer - description: Maximum number of results returned. - offset: - type: integer - description: Number of results skipped. - - # ──── Config Cleanup Schemas ──── - ZeroHitRulesResponse: - type: object - description: Response containing zero-hit security rules. - required: - - ok - - result - properties: - ok: - type: boolean - result: - $ref: '#/components/schemas/ZeroHitRulesResult' - - ZeroHitRulesResult: - type: object - description: Zero-hit rules result data. - required: - - status - - data - - total - properties: - status: - type: string - enum: [success, in_progress, failed] - currentTime: - type: string - format: date-time - lastAnalysisTime: - type: string - format: date-time - platform: - type: string - enum: [scm, panorama] - data: - type: array - items: - $ref: '#/components/schemas/ZeroHitRule' - limit: - type: integer - offset: - type: integer - total: - type: integer - - ZeroHitRule: - type: object - description: A security rule with zero traffic hits. - required: - - name - - uuid - - type - - location - - platform - properties: - name: - type: string - description: Rule name. - uuid: - type: string - description: Rule UUID. - type: - type: string - description: Rule type (e.g., "security", "nat"). - location: - type: string - description: Folder (SCM) or Device Group (Panorama). - platform: - type: string - enum: [scm, panorama] - created_time: - type: string - format: date-time - updated_time: - type: string - format: date-time - hit_timestamp: - type: string - format: date-time - description: Last hit timestamp (empty if never hit). - days_with_zero_hits: - type: integer - description: Number of days since the rule had zero hits. - description: - type: string - description: Rule description. - tag: - type: array - items: - type: string - description: Rule tags. - status: - type: string - description: Rule status (Panorama only). - disabled: - type: boolean - action: - type: string - description: Rule action (allow, deny, drop). - from: - type: array - items: - type: string - to: - type: array - items: - type: string - source: - type: array - items: - type: string - destination: - type: array - items: - type: string - application: - type: array - items: - type: string - service: - type: array - items: - type: string - profile_setting: - type: object - description: Security profile settings. - additionalProperties: true - - # ──── Compliance Framework Schemas ──── - ComplianceFrameworkRequest: - type: object - properties: - name: - type: string - description: Compliance framework name. - description: - type: string - description: Framework description. - source_url: - type: string - description: Source URL of the framework. - source: - type: string - description: Framework source/origin. - category: - type: string - description: Framework category. - enum: - - PCF - - CCF - hierarchy_header: - type: object - description: Hierarchy header metadata. - additionalProperties: true - hierarchy_data: - type: object - description: Hierarchical control structure. - properties: - children: - type: array - items: - $ref: '#/components/schemas/ControlNode' - logo: - type: object - description: Framework logo image. - properties: - image: - type: string - description: Base64 encoded image data. - type: - type: string - description: Image MIME type. - name: - type: string - description: Image filename. - - ControlNode: - type: object - description: Control node in the compliance framework hierarchy. - properties: - name: - type: string - description: Control name. - description: - type: string - description: Control description. - bpc_mapped: - type: array - description: Array of BPC IDs mapped to this control. - items: - type: integer - children: - type: array - description: Nested child controls. - items: - $ref: '#/components/schemas/ControlNode' - - ComplianceFramework: - type: object - properties: - id: - type: string - description: Compliance framework ID. - name: - type: string - description: Compliance framework name. - description: - type: string - description: Framework description. - source_url: - type: string - description: Source URL of the framework. - source: - type: string - description: Framework source/origin. - category: - type: string - description: Framework category. - enum: - - PCF - - CCF - status: - type: string - description: Framework status. - enum: - - draft - - released - releasable: - type: boolean - description: Whether the framework can be released. - hierarchy_header: - type: object - description: Hierarchy header metadata. - additionalProperties: true - hierarchy_data: - type: object - description: Hierarchical control structure. - properties: - children: - type: array - items: - $ref: '#/components/schemas/ControlNode' - logo: - type: object - description: Framework logo image. - properties: - image: - type: string - description: Base64 encoded image data. - type: - type: string - description: Image MIME type. - name: - type: string - description: Image filename. - created_at: - type: string - format: date-time - description: Creation timestamp. - updated_at: - type: string - format: date-time - description: Last update timestamp. - - ComplianceFrameworkListResponse: - type: object - properties: - data: - type: array - items: - $ref: '#/components/schemas/ComplianceFramework' - - ComplianceFrameworkSummaryResponse: - type: object - properties: - data: - type: array - items: - type: object - properties: - id: - type: string - description: Compliance framework ID. - category: - type: string - description: Framework category. - create_time: - type: integer - format: int64 - description: Framework creation timestamp (epoch milliseconds). - benchmark: - type: boolean - description: Whether this framework is a benchmark. - benchmark_by: - type: string - description: User who marked this framework as benchmark. - benchmark_time: - type: integer - format: int64 - description: Timestamp when framework was marked as benchmark. - revision_summary: - type: array - items: - type: object - properties: - name: - type: string - source_url: - type: string - source: - type: string - update_time: - type: integer - format: int64 - revision_id: - type: string - revision_name: - type: string - revision_number: - type: string - description: - type: string - state: - type: string - enum: - - draft - - released - overall_score: - type: integer - industry_score: - type: integer - data_available: - type: boolean - releasable: - type: boolean - updated_by: - type: string - logo: - type: object - properties: - image: - type: string - type: - type: string - name: - type: string - - OverallComplianceResponse: - type: object - properties: - products: - type: object - properties: - all: - $ref: '#/components/schemas/ProductCompliance' - ngfw: - $ref: '#/components/schemas/ProductCompliance' - sase: - $ref: '#/components/schemas/ProductCompliance' - category: - type: string - enum: ["PCF", "CCF"] - - ProductCompliance: - type: object - properties: - name: - type: string - data_available: - type: boolean - compliance: - type: object - properties: - overall_score: - type: integer - industry_score: - type: integer - categories: - type: array - items: - type: object - properties: - name: - type: string - enum: ["network", "infra", "security"] - compliance: - type: object - properties: - overall_score: - type: integer - industry_score: - type: integer - - ComplianceTimelineResponse: - type: object - properties: - timeline_30_days: - type: array - items: - $ref: '#/components/schemas/TimelineDataPoint' - timeline_1_year: - type: array - items: - $ref: '#/components/schemas/TimelineDataPoint' - - TimelineDataPoint: - type: object - properties: - ts: - type: integer - format: int64 - description: Timestamp in microseconds (epoch). - compliance_score: - type: integer - description: Compliance score (0-100). - data_available: - type: boolean - - ConfigurationsAssessedResponse: - type: object - properties: - configurations_assessed: - type: object - properties: - checks: - type: integer - assessments: - type: integer - total_exceptions: - type: integer - expiring_exceptions: - type: integer - - ComplianceControlsResponse: - type: object - properties: - empty: - type: boolean - compliance_framework_metadata: - type: object - properties: - id: - type: string - name: - type: string - assessment_date: - type: string - format: date - framework_version: - type: string - compliance_framework_control_groups: - type: array - items: - type: object - properties: - control_name: - type: string - data_available: - type: boolean - all: - type: object - properties: - most_severe: - type: object - properties: - category: - type: integer - category_name: - type: string - enum: - - "Informational" - - "Warning" - - "Critical" - count: - type: integer - failed: - type: integer - passed: - type: integer - overall_score: - type: number - format: float - group_stats: - type: object - additionalProperties: true - - BenchmarkMonitoringRequest: - type: object - properties: - product: - type: string - enum: - - sase - - ngfw - - all - bpc_status: - type: array - items: - type: string - severity: - type: array - items: - type: string - bpc_id: - type: array - items: - type: string - object_type: - type: array - items: - type: string - object_id: - type: array - items: - type: string - remediation_location: - type: array - items: - type: string - action: - type: array - items: - type: string - device_type: - type: array - items: - type: string - - BenchmarkMonitoringResponse: - type: object - properties: - device_serial: - type: array - items: - type: string - bpc_id: - type: array - items: - type: string - bpc_id_count: - type: array - items: - type: integer - manager: - type: array - items: - type: string - action: - type: array - items: - type: string - object_type: - type: array - items: - type: string - severity: - type: array - items: - type: string - location: - type: array - items: - type: string - remediation_location: - type: array - items: - type: string - object_id: - type: array - items: - type: string - pbpc_result_number: - type: array - items: - type: string - bpc_status: - type: array - items: - type: string - device_type: - type: array - items: - type: string - bpc_stats: - type: object - properties: - controls: - type: object - properties: - compliance_rate: - type: integer - data_available: - type: boolean - failed_assessments: - type: integer - severity: - type: object - properties: - critical: - type: integer - warning: - type: integer - informational: - type: integer - pass: - type: integer - exceptions: - type: object - properties: - total_exceptions: - type: integer - expiring_exceptions: - type: integer - severity: - type: object - properties: - critical: - type: integer - warning: - type: integer - informational: - type: integer - empty_filters: - type: boolean - update_time: - type: integer - format: int64 diff --git a/products/scm/docs/release-notes/release-notes.md b/products/scm/docs/release-notes/release-notes.md index e69ac6df3..15414b038 100644 --- a/products/scm/docs/release-notes/release-notes.md +++ b/products/scm/docs/release-notes/release-notes.md @@ -16,6 +16,73 @@ documentation, some of which have occurred in between API product releases. * [November 2024](/scm/docs/release-notes/november2024/) +## August 5th, 2026 + +Checks API: 10 new endpoints available. + +### New + +- **List Posture Checks.** New `GET /posture/checks/v1/all-checks` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + GET api.strata.paloaltonetworks.com/posture/checks/v1/all-checks + ``` + +- **Create Posture Check.** New `POST /posture/checks/v1/all-checks` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + POST api.strata.paloaltonetworks.com/posture/checks/v1/all-checks + ``` + +- **Batch Delete Posture Checks.** New `POST /posture/checks/v1/all-checks/batch-delete` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + POST api.strata.paloaltonetworks.com/posture/checks/v1/all-checks/batch-delete + ``` + +- **Batch Upsert Posture Checks.** New `POST /posture/checks/v1/all-checks/batch-upsert` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + POST api.strata.paloaltonetworks.com/posture/checks/v1/all-checks/batch-upsert + ``` + +- **Delete Posture Check.** New `DELETE /posture/checks/v1/all-checks/{id}` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + DELETE api.strata.paloaltonetworks.com/posture/checks/v1/all-checks/{id} + ``` + +- **Get Posture Check.** New `GET /posture/checks/v1/all-checks/{id}` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + GET api.strata.paloaltonetworks.com/posture/checks/v1/all-checks/{id} + ``` + +- **Update Posture Check.** New `PUT /posture/checks/v1/all-checks/{id}` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + PUT api.strata.paloaltonetworks.com/posture/checks/v1/all-checks/{id} + ``` + +- **Clone Posture Check.** New `POST /posture/checks/v1/all-checks/{id}:clone` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + POST api.strata.paloaltonetworks.com/posture/checks/v1/all-checks/{id}:clone + ``` + +- **Initiate a Config Upload.** New `POST /posture/checks/v1/reports/config-file-upload` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + POST api.strata.paloaltonetworks.com/posture/checks/v1/reports/config-file-upload + ``` + +- **Get BPA Processing Status.** New `GET /posture/checks/v1/reports/{id}/bpa-result` endpoint now available. + [Checks API reference →](/scm/api/checks) + ``` + GET api.strata.paloaltonetworks.com/posture/checks/v1/reports/{id}/bpa-result + ``` + +--- ## July 31st, 2026 Posture Management API: 26 new, 10 removed endpoints. Updated from v1.0 to v1.1.0.