API Commit for user specific changes

[batd2]

It looks like it is only possible to do full commit using API, which is not ideal on a production panorama, because it will commit the changes of all other users. 

When I create the changes and login using the API username, then I can commit the user specific changes, but not using an API call. 

Am I missing something? How can I commit only the changes made by the API user?

[batd2]

Can someone help?

[gfreeman · Accepted solution]

from panos import Panorama, PanoramaCommit

admin_list = ['admin1', 'admin2']
pano = Panorama('127.0.0.1', 'admin', 'secret')
command = PanoramaCommit('Commit for just these admins', admins=admin_list)

pano.commit(command)

[batd2]

@gfreeman Thank you, I wasn't aware of the feature. I think there is a bug in preventing from working (at least on the version I am testing with), but this looks like a bug on the Panorama side.

[JimmyHolland]

Hi @batd2, per-admin commit was released in 8.0 (https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-release-notes/pan-os-8-0-release-information/fea...) for reference.

[batd2]

@JimmyHolland it does not seem to work in API (at least not in 9.1). I still get full commit, even if the admin is specified, but I guess it is some sort of bug behaviour and good to know the feature is there. 

[JimmyHolland]

@batd2 Which version of 9.1 are you using for Panorama?

[JimmyHolland]

This works for me on 9.1.14:

https://{{host}}/api/?key={{key}}&type=commit&action=partial&cmd=<commit><partial><admin><member>{{admin}}</member></admin><device-group><member>{{device-group-name}}</member></device-group><no-template/><no-template-stack/><device-and-network>excluded</device-and-network><shared-object>excluded</shared-object></partial></commit>

[batd2]

@JimmyHolland Also on 9.1.14, but for me the above does full commit - the changes of all users are committed and not only of the specified user. 

[JimmyHolland]

Strange, it works fine for me, commits only the changes for the {{admin}} administrator specified. Can you share your API call @batd2?

[batd2]

@JimmyHolland It is working with the API call and using the SDK. Sorry, I must have been testing it previously with different PanOS version or I am not sure what was wrong.