invalid_src_credentials on REST API Login to prismacloud.io

[ELifshitz]

Hi All,

Trying to create a JWT token using the instructions on:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MQyCAM&lang=en_US

Basically I'm calling 

https://api.prismacloud.io/login with a previously created API Key using code that has worked before. (But using other credentials.)

The code fails and I'm getting the error response:

{ message: 'invalid_src_credentials' }

Has anyone seen this error message? I have previously seen a similar error when using invalid credential:

{"message":"invalid_credentials"}

But this error seems to indicate a different(?) problem, and I can't find anything regarding it...

Thanks for any help.

[JCalloway1]

Hello!
Are you using the SaaS version of Prisma Cloud?  Check your app stack . . . you shoudl be using api2, or api3, or api4 as apposed to just api.
So, you are using "a previously created API Key using code that has worked before. . . but using other credentials".  Double check the key and ensure that it has not expired, and that it's role and permission group allow it to do what you need it to do. 

Hope this helps!

[ELifshitz]

Thanks for your comments.

I think the URL I'm using is correct (api2, to be precise, based on the URL of the Prisma UI).

I will double-check permissions etc., but my gut feeling is that the "src" bit is the key here, and it seems to indicate that it's not a simple permissions error...

Again - Thanks!

[LMegrelis · Accepted solution]

Hello!

This may be a trusted IP login issue. 

Please see below documentation for reference. 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HExNCAW

Refer to Prisma Cloud documentation for a list of NAT Gateway IP Addresses for Prisma Cloud; adding the Ingress address of appropriate tenant to the Trusted Login IP Addresses list allows the API call to /api/v1/authenticate to be processed as expected.

Please keep us posted. 

[ELifshitz]

Thanks!
Marking this as a solution based on the documentation. Will try this and update ASAP.