API Keys

Choose language for code snippet

Python Php Go

In this section we present a workflow example to migrate a third party vendor configuration into a PANOS configuration.

Generating Expedition API Keys

In general, all the API calls to Expedition require user authentication, in order to validate the level of user rights to perform specific API calls. This is done through the use of API keys. The first step is to log into Expedition and retrieve an API key that would offer us access to later API calls.

As shown in Snippet 1, defines the Expedition IP to connect (ip variable),if you are using the container , the ip will be "localhost", credentials to be used for authentication (credentials) and the URL to access the login route (url).

Once those variables have been provided, creates and establishes an SSL connection (curl) to Expedition to make a request to the login URL with the specified credentials, and collects the response from the server into the response variable.

Expedition API responses are in JSON format. In the case of a generate_api_key API call, in the content section we will obtain an API key (apikey) and a CSRF Token (csrfToken). The first can be used for API consumption in scripts, while the second is intended for HTTPS Web UI requests. While the API key has an expiration time of 1 month and extends its validity time on every login (it may change in the future), a CSRF Token has a shorter validity and gets regenerated for each login call.

We collect the api_key by accessing the corresponding JSON element and remove the surrounding quotes to access the API key string and format it for future authenticated API calls.

info

This authentication credentials are later prepared in a hed variable that we will attach into the headers of the API calls we send in the future.

API syntax for generate API key:

Method	EndPoint	Parameters	Example Value
POST	https://localhost/api/v1/generate_api_key	username, password	{"username":"admin", "password":"paloalto"}

Python

import json
import sys
import argparse
import requests
from time import sleep
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

print('Generate_API_key')

ip="localhost" #your Expedition IP reachable from the Script execution machine
user="admin"
password="paloalto"

url = 'https://'+ip+'/api/v1/generate_api_key'
credentials = {"username":user, "password":password}

r = requests.post(url, data=credentials, verify=False)
response=r.json()
apiKey = json.dumps(response['Contents']['response']['data']['content']['api_key'])
auth_token = apiKey[1:-1]
print(auth_token)
print('')

hed = {'Authorization': 'Bearer ' + auth_token}

Php

echo  "Generate API Key \n";

$ip = "localhost"; //your Expedition IP reachable from the Script execution machine
$user = "admin";
$password = "paloalto";

$url = 'https://'.$ip.'/api/v1/generate_api_key';
$credentials =  array(
    "username" => $user,
    "password" => $password
);

$curl = curl_init($url);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($curl,CURLOPT_POST, TRUE);
curl_setopt($curl,CURLOPT_POSTFIELDS, $credentials);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);
$response = curl_exec($curl);

$jsonResponse = json_decode($response);
print_r($jsonResponse->Contents->response->{'response-messages'}->messages[0]->message);
$apiKey = $jsonResponse->Contents->response->data->content->api_key;
$auth_token = trim($apiKey,"'");

echo "\n";
$hed = array(
    'Authorization: Bearer ' . $auth_token,
);

Go

package main
import "fmt"

//TODO
//chech https://dev.to/m7shapan/golang-how-to-unmarshal-a-subset-of-nested-json-data-d84
type Response struct {
    Status string
    ApiKey string
}

func main() {
    fmt.Println("Generate API Key")

    var ip  := "localhost" //your Expedition IP reachable from the Script execution machine
    var user := "admin"
    var password := "paloalto"

    var url := "https://"+ip+"/api/v1/generate_api_key"

    payloadBytes, err := json.Marshal(map|string|string{
        "name": user,
        "password": password
    })

    if err != nil {
        log.Fatalln(err)
    }
    body := bytes.NewReader(payloadBytes)

    req, err := http.Post(url, "application/json", bytes.NewBuffer(requestBody))
    if err != nil {
        log.Fatalln(err)
    }

    defer resp.Body.Close()

    jsonResponse := Response{}

    err := json.Unmarshal([]byte(resp), &jsonResponse)
    if err != nil {
        log.Fatalln(err)
    }

    var auth_token := jsonResponse.ApiKey

    var hed := {'Authorization: Bearer ' + auth_token}
}