topic Re: Response status error code 403 while using api in Next-Generation Firewall Discussions

Response status error code 403 while using api

ssovee — Wed, 30 Aug 2023 06:44:24 GMT

Hello all. I'm trying to get started with some API work on my PAN OS. I walked through the Getting Started guide and I created a user, assigned an admin role to it that had API access, and then generated a key.
While I am using curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><system><info></info></system></show>&key=LUFRPT1.....cQ==" it shows <response status="success"> but while I am trying curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="op" cookie="7671262853440057" uid="1004"><operations><show><virtual-wire>all</virtual-wire></show></operations></request>&key=LUFRPT1.....cQ==" it shows "<response status = 'error' code = '403'><result><msg>Invalid Credential</msg></result></response>" .
Even while I am trying to create address group facing the same issue.

Re: Response status error code 403 while using api

akuzhuppilly — Thu, 31 Aug 2023 05:12:57 GMT

Hello @ssovee

You are using a cookie value in the curl request.

cookie="7671262853440057" uid="1004"

Can you remove this value and test the status?

Re: Response status error code 403 while using api

ssovee — Sat, 02 Sep 2023 08:08:58 GMT

Getting the same result....

curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="op"><operations><show><virtual-wire>all</virtual-wire></show></operations></request>&key=L.................FqcQ=="
<response status = 'error' code = '403'><result><msg>Invalid Credential</msg></result></response>

Re: Response status error code 403 while using api

TomYoung — Sat, 02 Sep 2023 14:23:49 GMT

Hi @ssovee ,

That's a good start! I have a couple of observations:

Invalid Credential most likely means the key is wrong. You may want to double check the key.
You have too much in your 2nd URL. You should get rid of the "<request cmd="op"><operations>" and "</operations></request>". Those were not in your 1st URL and not needed.
Have you tried the XML API Browser? You can drill down in the menu and get the exact URL syntax you need. You can also add the "all" keyword (which is correct) and click Submit to test. You can fully test your XML syntax before using it in curl.
The command curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><virtual-wire>all</virtual-wire></show>&key=CorrectKey" works for me.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/explore-the-api/use-the-api-browser

Thanks,

Tom

Re: Response status error code 403 while using api

ssovee — Sat, 02 Sep 2023 15:21:11 GMT

Hi,

It works for me. Thank you. I went through the document you shared.
I have created an address group and at the same time browse https://firewall/debug page. Then found the output below.

[2023/09/02 21:00:43] [44m panui_core\mgmt\MSConnection [0m (DEBUG) 5877532556119778 - -
socket 106 sending request <request cmd="complete" obj="/config/devices/entry[@name='localhost.localdomain']/vsys" cookie="5877532556119778"/>
[2023/09/02 21:00:43] [44m panui_core\mgmt\MSConnection [0m (DEBUG) 5877532556119778 - -
socket 106 response took 0.003s <response status="success" code="19">
<completions>
<completion value="vsys1" vxpath="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']" current="yes"/>
</completions>
</response>
[02-Sep-2023 21:00:43 Asia/Dhaka] [2023/09/02 21:00:43] [41m panui_core\mgmt\MSConnection [0m (DEBUG) 5877532556119778 - -
socket 40 sending request <request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='01818090909']" cookie="5877532556119778" newonly="yes">
<dynamic>
<filter>"Ubuntu"</filter>
</dynamic>
</request>

[02-Sep-2023 21:00:43 Asia/Dhaka] [2023/09/02 21:00:43] [41m panui_core\mgmt\MSConnection [0m (DEBUG) 5877532556119778 - -
socket 40 response took 0.054s <response status="success" code="20">
<msg>command succeeded</msg>
</response>
Now I am trying to create an address group using the below command and it shows the Invalid credential msg again.
curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='01819810810']"newonly="yes"><dynamic><filter>"Ubuntu"</filter></dynamic></request>&key=LUFRPT.............FqcQ=="

Maybe I am missing something. I would appreciate it if you could help me with this. Thanks in advance.