Python XML API Create policy issue

L1 Bithead

Python XML API Create policy issue

My PA3020 version is 7.0.3, when i use python xml api create a policy return(<response status="error" code="5"><msg>Could not copy parent object in set handler</msg></response>)


can someone help me?

I know version 9.0 can use json api,but now can not 


Python code below:

import requests
import urllib3
import xml.etree.cElementTree as ET
except ImportError:
import xml.etree.ElementTree as ET

def __init__(self,host): = host
self.__username = 'api'
self.__password = 'python'
self.verify = False
self.url = 'https://{}/api'.format(
self.key = self.apikey()
def apikey(self):
params = {'type':'keygen','user:':self.__username,'password':self.__password}
r = requests.get(url=self.url,params=params,verify=self.verify)
res = ET.fromstring(r.text)
if res.attrib['status'] != 'success':
print('Generate API key failed for host {}.\nPlease check user/passwd/etc.'.format(
key = [i.text for i in res.iter('key')][0]
return key
def config(self):
xpathvalue = '/config/devices/entry[@name="localhost.localdomain"]/vsys/entry[@name="vsys1"]/rulebase/security/rules/entry[@name="python"]'
elementvalue = '<from><member>trust</member></from>' \
'<to><member>untrust</member></to>' \
'<destination><member>any</member></destination>' \
'<application><member>any</member></application>' \
'<service><member>any</member></service>' \
'<source><member>any</member></source>' \
params = {'type':'config','action':'set','key':self.key,
r =, params=params, verify=self.verify)
return r.text
if __name__ == '__main__':
host = ''
pa = Paloalto(host)


L4 Transporter

Re: Python XML API Create policy issue

I would recommend using pandevice if you're looking to do automation with PAN-OS in python.


But to answer the question, your XML is improper, there's no opening and closing tag surrounding the element you're passing in.  If you surround what you currently have in <entry name="python"> / </entry>, it should get you around the error code you're getting now.


Also, if you're doing a set, I think your XPATH should not have the '/entry[@name="python"]' part, that should only be there if you're doing an edit.  It's stuff like this that pandevice helps out with.

L1 Bithead

Re: Python XML API Create policy issue

@gfreeman Thanks for you reply.

Maybe some problems in my xml body, so can you show a example policy xml body.

I will test Pandevice module, I think XML rest api speed is better pandevice.

Many thanks

L4 Transporter

Re: Python XML API Create policy issue

<entry name="deny all and log"><from><member>any</member></from><to><member>any</member></to><source><member>any</member></source><source-user><member>any</member></source-user><hip-profiles><member>any</member></hip-profiles><destination><member>any</member></destination><application><member>any</member></application><service><member>application-default</member></service><category><member>any</member></category><action>deny</action></entry>


Just as an FYI, you can always see what XML the PAN-OS is creating using any of the following methods:

L1 Bithead

Re: Python XML API Create policy issue

@gfreeman many thanks !!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!