Panorama Edit a security post-rule REST-API logic

abedJawhar — Wed, 15 Jun 2022 13:51:15 GMT

Hi,

I was wondering if I'm using the edit security post-rule endpoint correctly or I'm missing something here.

I am sending an HTTP PUT request to the panorama to update an existing security rule, but according to the documentation, if I want to update a single field (say the Source Address list), I need to send in the payload all the other fields that are already configured on the rule, even though I'm not changing them. I tried sending the PUT request with just the source field, bit I got a response that I'm missing required fields.

Is this the normal behaviour of the edit endpoint? It's treating it the same way as the Add endpoint (POST Create a Security Post Rule). Any way I can use that endpoint by just sending the field I need to update and not every single field configured on the rule that I'm not editing?

An example of the PUT request sent that failed cause of missing fields:

requests.put(url="https://{{host}}/restapi/v9.1/Policies/SecurityPostRules?location=device-group&device-group={{dg_name}}&name={{rule_name}}", headers={"X-PAN-KEY": "{{key}}"}, data={"entry": {\"@name\": "{{rule_name}}", "source": {"member": ["NEW_ADDR_GRP"]}}}, verify=False)

And we get this response:

{"code":3,"message":"Invalid Object","details":[{"@type":"CauseInfo","causes":[{"code":12,"module":"panui_mgmt","description":"Invalid Object: {{rule_name}} is missing 'from'."}]}])

When I add "from" to the pauload I get i'm missing "to", and this goes on until I have all the required fields from the Create endpoint in the payload, but it overwrites the optional fields that I did not include in my Edit payload.

Thanks

Re: Panorama Edit a security post-rule REST-API logic

JimmyHolland — Tue, 13 Sep 2022 12:01:05 GMT

Hi @abedJawhar, yes, this is expected behaviour for a PUT in a RESTful API, where PUT methods normally expect the entire definition of a resource, because it replaces the resource definition. This is useful to maintain idempotent operations amongst other reasons. The PAN-OS REST API works in the same way with the PUT-based methods. It would be best to, in your code, do a GET first, modify the resource, then do a PUT.

A feature request for future would be a PATCH-based HTTP method for the PAN-OS REST API to be able to provide partial resource definitions.

Re: Panorama Edit a security post-rule REST-API logic

abedJawhar — Tue, 13 Sep 2022 12:13:54 GMT

Thanks for the info

topic Re: Panorama Edit a security post-rule REST-API logic in Automation/API Discussions

Panorama Edit a security post-rule REST-API logic

Re: Panorama Edit a security post-rule REST-API logic

Re: Panorama Edit a security post-rule REST-API logic