topic Re: REST API to get the list of members in a dynamic group object in Panorama Discussions

REST API to get the list of members in a dynamic group object

marie-merlier — Fri, 31 Jan 2025 14:28:05 GMT

Hello,

I'd like to retrieve the list of members of a dynamic group object using API.

It's working fine to obtain the members of a static list

- the following request

/restapi/v11.1/Objects/AddressGroups?name=mystaticgroup&location=shared

returns a json like

"static": {

"member": [

"member1name",

"member2name",

"member3name"

]

- the same request with a dynamic group instead returns something like

"dynamic": {

"filter": "'cts.svr_ISE.sgt_ISE_compliant'"

with no members viewable.

is there a hidden command that could let me view what's inside a dynamic list ?

Re: REST API to get the list of members in a dynamic group object

TomYoung — Thu, 27 Feb 2025 22:41:28 GMT

Hi @marie-merlier ,

I see that you are using the REST API. The REST API is used for CRUD operations. https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-panorama-api/get-started-with-the-pan-os-rest-api/pan-os-rest-api

I would guess since viewing the dynamic members of a groups is more an operational command and not a configuration create/read/update/delete command that it is not available on the REST API. Here is the syntax on the XML API to run the operational command:

/api/?type=op&cmd=<show><object><dynamic-address-group><name>mydynamicgroup</name></dynamic-address-group></object></show>

Thanks,

Tom

Re: REST API to get the list of members in a dynamic group object

marie-merlier — Fri, 28 Feb 2025 10:34:37 GMT

Hi @TomYoung ,

Thank you for you reply!

I've tested it on my dynamic group, but it returns an empty list like

<dyn-addr-grp>

<entry>

<member-list>

</member-list>

</entry

</dyn-addr-grp>

It's a list based on SGT filter, I'm able to see what's inside in Panorama WebUI, only when I'm on the concerned device-group.

But there is no such filter for the API, maybe this is why I see an empty list ?

I think I will open a ticket with Palo to investigate it.

Re: REST API to get the list of members in a dynamic group object

TomYoung — Fri, 28 Feb 2025 17:29:25 GMT

Hi @marie-merlier ,

I have a DAG that is IP-based, and I cannot see it on Panorama. I have to connect to the NGFW to see the members.

Very interesting.

Thanks,

Tom