Response status error code 403 while using api

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Response status error code 403 while using api

L2 Linker

Hello all. I'm trying to get started with some API work on my PAN OS. I walked through the Getting Started guide and I created a user, assigned an admin role to it that had API access, and then generated a key.
While I am using curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><system><info></info></system></show>&key=LUFRPT1.....cQ==" it shows <response status="success"> but while I am trying curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="op" cookie="7671262853440057" uid="1004"><operations><show><virtual-wire>all</virtual-wire></show></operations></request>&key=LUFRPT1.....cQ==" it shows "<response status = 'error' code = '403'><result><msg>Invalid Credential</msg></result></response>" .
Even while I am trying to create address group facing the same issue.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @ssovee ,

 

That's a good start!  I have a couple of observations:

 

  1. Invalid Credential most likely means the key is wrong.  You may want to double check the key.
  2. You have too much in your 2nd URL.  You should get rid of the "<request cmd="op"><operations>" and "</operations></request>".  Those were not in your 1st URL and not needed.
  3. Have you tried the XML API Browser?  You can drill down in the menu and get the exact URL syntax you need.  You can also add the "all" keyword (which is correct) and click Submit to test.  You can fully test your XML syntax before using it in curl.
  4. The command curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><virtual-wire>all</virtual-wire></show>&key=CorrectKey" works for me.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

4 REPLIES 4

L4 Transporter

Hello @ssovee 

You are using a cookie value in the curl request.

cookie="7671262853440057" uid="1004"

Can you remove this value and test the status?

Anoopkumar
Network Security Engineer

Getting the same result....

curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="op"><operations><show><virtual-wire>all</virtual-wire></show></operations></request>&key=L.................FqcQ=="
<response status = 'error' code = '403'><result><msg>Invalid Credential</msg></result></response>

Cyber Elite
Cyber Elite

Hi @ssovee ,

 

That's a good start!  I have a couple of observations:

 

  1. Invalid Credential most likely means the key is wrong.  You may want to double check the key.
  2. You have too much in your 2nd URL.  You should get rid of the "<request cmd="op"><operations>" and "</operations></request>".  Those were not in your 1st URL and not needed.
  3. Have you tried the XML API Browser?  You can drill down in the menu and get the exact URL syntax you need.  You can also add the "all" keyword (which is correct) and click Submit to test.  You can fully test your XML syntax before using it in curl.
  4. The command curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<show><virtual-wire>all</virtual-wire></show>&key=CorrectKey" works for me.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Hi,

It works for me. Thank you. I went through the document you shared. 
I have created an address group and at the same time browse https://firewall/debug page. Then found the output below.

[2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 106 sending request <request cmd="complete" obj="/config/devices/entry[@name='localhost.localdomain']/vsys" cookie="5877532556119778"/>
[2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 106 response took 0.003s <response status="success" code="19">
<completions>
<completion value="vsys1" vxpath="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']" current="yes"/>
</completions>
</response>
[02-Sep-2023 21:00:43 Asia/Dhaka] [2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 40 sending request <request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='01818090909']" cookie="5877532556119778" newonly="yes">
<dynamic>
<filter>"Ubuntu"</filter>
</dynamic>
</request>

[02-Sep-2023 21:00:43 Asia/Dhaka] [2023/09/02 21:00:43]  panui_core\mgmt\MSConnection  (DEBUG) 5877532556119778 - -
socket 40 response took 0.054s <response status="success" code="20">
<msg>command succeeded</msg>
</response>
Now I am trying to create an address group using the below command and it shows the Invalid credential msg again.
curl -k -X GET "https://a.b.c.d/api/?type=op&cmd=<request cmd="set" obj="/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='01819810810']"newonly="yes"><dynamic><filter>"Ubuntu"</filter></dynamic></request>&key=LUFRPT.............FqcQ=="

 

Maybe I am missing something. I would appreciate it if you could help me with this. Thanks in advance.

  • 1 accepted solution
  • 3221 Views
  • 4 replies
  • 1 Likes
  • 38 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!