topic Re: API Commit for user specific changes in Automation/API Discussions

API Commit for user specific changes

batd2 — Fri, 15 Jul 2022 08:17:33 GMT

It looks like it is only possible to do full commit using API, which is not ideal on a production panorama, because it will commit the changes of all other users.

When I create the changes and login using the API username, then I can commit the user specific changes, but not using an API call.

Am I missing something? How can I commit only the changes made by the API user?

Re: API Commit for user specific changes

batd2 — Thu, 04 Aug 2022 06:51:07 GMT

Can someone help?

Re: API Commit for user specific changes

gfreeman — Tue, 09 Aug 2022 15:11:44 GMT

from panos import Panorama, PanoramaCommit admin_list = ['admin1', 'admin2'] pano = Panorama('127.0.0.1', 'admin', 'secret') command = PanoramaCommit('Commit for just these admins', admins=admin_list) pano.commit(command)

Re: API Commit for user specific changes

batd2 — Fri, 12 Aug 2022 14:07:35 GMT

@gfreeman Thank you, I wasn't aware of the feature. I think there is a bug in preventing from working (at least on the version I am testing with), but this looks like a bug on the Panorama side.

Re: API Commit for user specific changes

JimmyHolland — Mon, 26 Sep 2022 12:50:39 GMT

Hi @batd2, per-admin commit was released in 8.0 (https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-release-notes/pan-os-8-0-release-information/features-introduced-in-pan-os-8-0/management-features#id3dab648a-3abf-4edb-aba0-926d49bc2593) for reference.

Re: API Commit for user specific changes

batd2 — Mon, 26 Sep 2022 13:16:19 GMT

@JimmyHolland it does not seem to work in API (at least not in 9.1). I still get full commit, even if the admin is specified, but I guess it is some sort of bug behaviour and good to know the feature is there.

Re: API Commit for user specific changes

JimmyHolland — Tue, 27 Sep 2022 15:40:53 GMT

@batd2 Which version of 9.1 are you using for Panorama?

Re: API Commit for user specific changes

JimmyHolland — Wed, 28 Sep 2022 13:10:29 GMT

This works for me on 9.1.14:

https://{{host}}/api/?key={{key}}&type=commit&action=partial&cmd=<commit><partial><admin><member>{{admin}}</member></admin><device-group><member>{{device-group-name}}</member></device-group><no-template/><no-template-stack/><device-and-network>excluded</device-and-network><shared-object>excluded</shared-object></partial></commit>

Re: API Commit for user specific changes

batd2 — Wed, 28 Sep 2022 14:01:24 GMT

@JimmyHolland Also on 9.1.14, but for me the above does full commit - the changes of all users are committed and not only of the specified user.

Re: API Commit for user specific changes

JimmyHolland — Wed, 28 Sep 2022 14:17:37 GMT

Strange, it works fine for me, commits only the changes for the {{admin}} administrator specified. Can you share your API call @batd2?

Re: API Commit for user specific changes

batd2 — Wed, 28 Sep 2022 16:36:57 GMT

@JimmyHolland It is working with the API call and using the SDK. Sorry, I must have been testing it previously with different PanOS version or I am not sure what was wrong.