topic Re: Call API key via invoke-restmethod in General Topics

Call API key via invoke-restmethod

turturici — Thu, 02 Nov 2017 18:08:12 GMT

Is Palo Alto's API able to accept GET requests from the PowerShell "invoke-restmethod" cmdlet which have the api key set as a variable? I ask this because I would like to run these requests without embedding my API key in the HTTPS GET request. This does not seem secure to me. Rather, I would like to store the API key elsewhere and have PowerShell call that file to insert the key in to the string, or elsewhere in the request, like in the Authorization header. I've been toying around with this to no avail. I'm wondering if the API can handle this type of request? Has anyone come up against this and prevailed?

Re: Call API key via invoke-restmethod

chrislss — Thu, 02 Nov 2017 19:05:19 GMT

I haven't used it yet, but came across a pan-python module on the api-lab site that uses a .panrc file on the local host to reference a Palo Alto firewall IP and the associated API key. That file is referenced during api calls to pass in the key without specifying it on the command line.

Obviously not Powershell, but may be adaptable.

http://api-lab.paloaltonetworks.com/module-1.html

chrislss

Re: Call API key via invoke-restmethod

turturici — Fri, 03 Nov 2017 15:22:07 GMT

I finally figured it out...simple (usually is).

Set a variable in your script that looks for your apikey elsewhere, like:

$apikey = Get-Content "<path_to_file>"

Then, simply make your "key" a variable in the HTTPS request. For example:

https://hostname/api/?type=config$action=get&xpath=/config&key=$apikey

Done.

However, I'm now having other problems with the x-path...back to the drawing board.