Response status error code 403 while using api

[ssovee]

Hello all. I'm trying to get started with some API work on my PAN OS. I walked through the Getting Started guide and I created a user, assigned an admin role to it that had API access, and then generated a key.
While I am using curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><system><info></info></system></show>&key=LUFRPT1.....cQ==" it shows <response status="success"> but while I am trying curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="op" cookie="7671262853440057" uid="1004"><operations><show><virtual-wire>all</virtual-wire></show></operations></request>&key=LUFRPT1.....cQ==" it shows "<response status = 'error' code = '403'><result><msg>Invalid Credential</msg></result></response>" .
Even while I am trying to create address group facing the same issue.

[akuzhuppilly]

Hello @ssovee 

You are using a cookie value in the curl request.

cookie="7671262853440057" uid="1004"

Can you remove this value and test the status?

[ssovee]

Getting the same result....

curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="op"><operations><show><virtual-wire>all</virtual-wire></show></operations></request>&key=L.................FqcQ=="
<response status = 'error' code = '403'><result><msg>Invalid Credential</msg></result></response>

[TomYoung · Accepted solution]

Hi @ssovee ,

That's a good start!  I have a couple of observations:

1. Invalid Credential most likely means the key is wrong.  You may want to double check the key.
2. You have too much in your 2nd URL.  You should get rid of the "<request cmd="op"><operations>" and "</operations></request>".  Those were not in your 1st URL and not needed.
3. Have you tried the XML API Browser?  You can drill down in the menu and get the exact URL syntax you need.  You can also add the "all" keyword (which is correct) and click Submit to test.  You can fully test your XML syntax before using it in curl.
4. The command curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><virtual-wire>all</virtual-wire></show>&key=CorrectKey" works for me.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

Thanks,

Tom

[ssovee]

Hi,

It works for me. Thank you. I went through the document you shared. 
I have created an address group and at the same time browse https://firewall/debug page. Then found the output below.

[2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 106 sending request <request cmd="complete" obj="/config/devices/entry[@name='localhost.localdomain']/vsys" cookie="5877532556119778"/>
[2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 106 response took 0.003s <response status="success" code="19">
<completions>
<completion value="vsys1" vxpath="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']" current="yes"/>
</completions>
</response>
[02-Sep-2023 21:00:43 Asia/Dhaka] [2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 40 sending request <request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='01818090909']" cookie="5877532556119778" newonly="yes">
<dynamic>
<filter>"Ubuntu"</filter>
</dynamic>
</request>

[02-Sep-2023 21:00:43 Asia/Dhaka] [2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 40 response took 0.054s <response status="success" code="20">
<msg>command succeeded</msg>
</response>
Now I am trying to create an address group using the below command and it shows the Invalid credential msg again.
curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='01819810810']"newonly="yes"><dynamic><filter>"Ubuntu"</filter></dynamic></request>&key=LUFRPT.............FqcQ=="

Maybe I am missing something. I would appreciate it if you could help me with this. Thanks in advance.