topic Re: PAN-OS 10.2 API key acquisition without password in URL? in Automation/API Discussions

PAN-OS 10.2 API key acquisition without password in URL?

SSargent_ICTWA — Thu, 01 Sep 2022 18:43:56 GMT

Is it possible to request an API key via "/api/?type=keygen" without providing the account password in the URL? This seems like a notable security issue since the URL is not encrypted. These pages suggest it is possible: Authenticate Your API Requests, API Authentication and Security. However, my testing of the "Authentication: Bearer" header via "/api/?type=keygen" results in an error about a missing user parameter.

Edit: Typing from memory - bad. That header should be "Authorization: Basic ..."

Re: PAN-OS 10.2 API key acquisition without password in URL?

gfreeman — Thu, 01 Sep 2022 17:58:24 GMT

Giving the authentication information via body in a POST is still supported in PAN-OS v10.2. Both the pan-os-python and pango libraries do it this way, and still supply the API key as part of the body in API requests.

Re: PAN-OS 10.2 API key acquisition without password in URL?

SSargent_ICTWA — Thu, 01 Sep 2022 19:00:02 GMT

@gfreeman Thanks for mentioning the POST/body option. I found the specifics in the third example here: Structure of a PAN-OS XML API Request