How to get Applications using XML API

[FredWiest]

I am trying to get a list of applications, or a single application using the XML API. I have tried the following:

api/?type=config&action=get&xpath=/config/shared/application

api/?type=config&action=get&xpath=/config/shared/application/entry[@name='icmp']

api/?type=config&action=get&xpath=/config/predefined/application/entry[@name='icmp']

None of these work. What am I missing?

[BPry]

@FredWiest,

/api/?type=config&action=get&xpath=/config/predefined/application/entry[@name='icmp']

The above is a perfectly valid API call and will respond with the following XML response. What is the response actually telling you when you make the call? Are you actually authenticated? 

<response status="success" code="19">
<result total-count="1" count="1">
<entry id="1" name="icmp" ori_country="USA" ori_language="English">
<category>networking</category>
<subcategory>ip-protocol</subcategory>
<technology>network-protocol</technology>
<evasive-behavior>no</evasive-behavior>
<consume-big-bandwidth>no</consume-big-bandwidth>
<used-by-malware>yes</used-by-malware>
<able-to-transfer-file>no</able-to-transfer-file>
<has-known-vulnerability>yes</has-known-vulnerability>
<tunnel-other-application minver="3.0.0">yes</tunnel-other-application>
<prone-to-misuse>no</prone-to-misuse>
<pervasive-use>yes</pervasive-use>
<decode minver="3.0.0">icmp</decode>
<references>
<entry name="Wikipedia">
<link>
http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol
</link>
</entry>
</references>
<default>
<ident-by-ip-protocol>1</ident-by-ip-protocol>
</default>
<tunnel-applications minver="3.0.0">
<member minver="3.0.0">ping</member>
</tunnel-applications>
<risk>4</risk>
</entry>
</result>
</response>

[FredWiest]

Well, thats interesting... it now works for me, so I'm not sure what I did wrong. What I am trying to do is get or edit the Tags attribute, but I don't see Tags in the returned XML. I'm guessing that the Application data is in the config/predefined since we can't change it, but maybe the Tags attribute is in the config/shared data? Do you know where I can find that?

[BPry]

@FredWiest,

Totally different element in the configuration. Tags are actually present under <application-tag> instead of <application>. So the API request to show tags for icmp would be the following:

/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/application-tag/entry[@name='icmp']

[FredWiest]

When I used the command you gave above I get "<response status="success" code="7"><result /></response>". My firewall is 8.0.13.

Since I am trying to change it on a Panorama, wouldn't I need something like "api/?type=config&action=get&xpath=/config/devices/application-tag/entry[@name='icmp']"? That fails with the same message

[BPry]

@FredWiest,

You can utilize the API browser to figure out the exact command that you would need to utilize, the example that I gave you was off of a firewall not Panorama. 

[FredWiest]

Thank you for the reply. The problem is that I can't find any reference to application-tag in the API browser. I have tried to go down every path but would expect it to be in the Configuration Commands->Shared path. But there is no reference to this object anywhere that I look. This is on a Panorama running 9.0.2. I have spent hours Googling and on the Palo site and can't find any references to application-tag. So I'm out of ideas.

[FredWiest]

OK, in case anyone would like the solution to this. I was looking in the wrong direction. When you are working with Panorama, it is the Devices->Device-Group path. Below is for the Global Device Group.

To get the application-tag:

&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Global']/application-tag/entry[@name='ssh']/tag

And to edit the application-tag:

&action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Global']/application-tag/entry[@name='100bao']/tag/member&element=<member>Sanctioned</member>

Using the tag "empty" you can clear the tag, but strangely enough, it sets the "Remove Tag Inheritance" flag. Anyone know why it does that?

action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Global']/application-tag/entry[@name='100bao']/tag/member&element=<member>empty</member>