Unable to execute custom-dynamic-report (502 bad gateway + Unauthorized request)

[johnfstack8]

I'm trying to create and execute a completely dynamic report as described in 2.5.3 Custom reports in this XML API documentation [1]. This reporting is being performed on a panorama running PANOS-6.0.3.

When I try to download a report I get the following error (I've tried a few different methods of URL encoding as curl doesn't like the [ and @ characters]):

curl -k "https://x.x.x.x/api/?type=config&action=get&key=redacted=&path=/config/devices/entry/vsys/entry%5B%4..."

<response status="unauth" code="16"><msg><line>Unauthorized request</line></msg></response>

I then exported the configuration in XML form to get access to the raw underlying report definition and tried to execute it directly as follows

curl -k "https://x.x.x.x/api/?type=report&reporttype=dynamic&reportname=custom-dynamic-report&key=redacted=&c...<entry name=\"office-user-report\"><type><panorama-trsum><sortby>sessions</sortby><aggregate-by><member>app</member><member>srcuser</member></aggregate-by><values><member>sessions</member><member>bytes</member></values></panorama-trsum></type><period>last-24-hrs</period><topn>50</topn><topm>10</topm><caption>office-user-report</caption><query>(addr in '192.168.1.0/24') and (app neq dns) and (app neq ntp)</query></entry>"

I always receive back a bad gateway response:

<html>

<head><title>502 Bad Gateway</title></head>

<body bgcolor="white">

<center><h1>502 Bad Gateway</h1></center>

<hr><center></center>

</body>

</html>

I have a support case open on this issue as well, please contact me privately if you would like it, it's associated with this support account.

[1] https://live.paloaltonetworks.com/servlet/JiveServlet/previewBody/6607-102-11-31905/XML-API-6.0.pdf

[ksteves1]

curl doesn't URL-encode your GET QUERY_STRING.

also, you want to remove the outer <entry> container on your cmd= XML.

Suggest you use POST and try something like this:

$ curl -k -d "type=report&reporttype=dynamic&reportname=custom-dynamic-report&key=$KEY" --data-urlencode "cmd=<type><panorama-trsum><sortby>sessions</sortby><aggregate-by><member>app</member><member>srcuser</member></aggregate-by><values><member>sessions</member><member>bytes</member></values></panorama-trsum></type><period>last-24-hrs</period><topn>50</topn><topm>10</topm><caption>office-user-report</caption><query>(addr in '192.168.1.0/24') and (app neq dns) and (app neq ntp)</query>" https://172.25.1.251/api/