PCCE API limits not working for NON paginated endpoints

[edoardo.vicendone]

Hello,

We are using Prisma Cloud Compute Edition (PCCE) on premise and we are inquiring the REST API endpoints to get data into Splunk.

Some endpoints are paginated, therefore we have implemented the logic described here and it is working fine:

https://prisma.pan.dev/api/cloud/cwpp/21-04/api-limits

https://<CONSOLE>/api/v1/images?limit=50&offset=X

The problem now comes with NON paginated endpoints, like /defenders/summary

In the official documentation we do not find any information if the endpoint is paginated or not. Furthermore if you pass the limit and offset to a NON paginated endpoint it always reply with the same results instead of providing an empty result (like it happen for paginated API). See here below an example:

Example 1: Request without using paginated logics

There are only 4 results, and it works just fine.

curl -k \

-u myuser:mypassword \

-H 'Content-Type: application/json' \

-X GET \

-g "https://centralconsole.mydomain.net:8083/api/v1/defenders/summary?project=myProject"

[{"category":"container","connected":12,"deployed":12,"licensed":0}

,{"category":"host","connected":0,"deployed":0,"licensed":0}

,{"category":"serverless","connected":0,"deployed":0,"licensed":0}

,{"category":"appEmbedded","connected":0,"deployed":0,"licensed":0}

]

Example 2: Request using paginated logics

There are only 4 results, and it works just fine for the first request (limit=50, offset=0)

curl -k \

-u myuser:mypassword \

-H 'Content-Type: application/json' \

-X GET \

-g "https://centralconsole.mydomain.net:8083/api/v1/defenders/summary?project=myProject&limit=50&offset=..."

[{"category":"container","connected":12,"deployed":12,"licensed":0}

,{"category":"host","connected":0,"deployed":0,"licensed":0}

,{"category":"serverless","connected":0,"deployed":0,"licensed":0}

,{"category":"appEmbedded","connected":0,"deployed":0,"licensed":0}

]

Now the second request (limit=50, offset=50) should reply with no results because offset is greater than the available results.

Instead it always give 4 results, we think this is wrong.

curl -k \

-u myuser:mypassword \

-H 'Content-Type: application/json' \

-X GET \

-g "https://centralconsole.mydomain.net:8083/api/v1/defenders/summary?project=myProject&limit=50&offset=..."

[{"category":"container","connected":12,"deployed":12,"licensed":0}

,{"category":"host","connected":0,"deployed":0,"licensed":0}

,{"category":"serverless","connected":0,"deployed":0,"licensed":0}

,{"category":"appEmbedded","connected":0,"deployed":0,"licensed":0}

]

We think this behavior should be corrected OR (but this is a worse solution) in the documentation it should be indicated if the endpoint support paginated/non paginated responses.

Prisma Cloud

Thanks a lot,

Edoardo

[RPrasadi]

It sounds like a request to fix functionality of the API, I suggest opening a support case.

https://support.paloaltonetworks.com/