topic Re: python api script in API / CLI Discussion

python api script

Roberts12 — Sun, 22 Jan 2023 13:55:10 GMT

Hi,

I have installed latest version of checkpoint mgmt R81.20 in a test environment and want to use the latest API: https://sc1.checkpoint.com/documents/latest/APIs/#introduction~v1.9%20

I want to automate some tasks using python script from my desktop pc, not run the script directly on checkpoint gateway. I tried with checkpoints official python SDK: https://github.com/CheckPointSW/cp_mgmt_api_python_sdk

But the API commands for the python SDK do not match with the latest Management API Reference v1.9 from checkpoint?

For example from python sdk example:

add_rule_response = client.api_call("add-access-rule",

{"name": rule_name, "layer": "Network", "position": "top"})

and example from Management API Reference v1.9:

Command

add access-rule layer "Network" position 1 name "Rule 1" service.1 "SMTP" service.2 "AOL" vpn "MyIntranet"

And also I do not find in the documentation for the python SDK all the avaible commands and how to handle session etc. Since the commands are not identical I wonder how to proceed.

Please advice and help me get started.

If i want to use latest Management API Reference v1.9, should i instead use web api in the python script instead of the python sdk?

Regards

Re: python api script

StuartGreen — Mon, 23 Jan 2023 10:30:01 GMT

Hi, I would start with the REST API and use something simple like Python requests to manage the connections. I've worked on several projects recently and didn't need the full SDK. Depending on what you're trying to work on, you might find that something like Ansible is more convenient for you. There are some examples of both approaches here https://developer.checkpoint.com or I've used a simple wrapper package here https://github.com/chkp-stuartgreen/policy-automation-poc/blob/main/packages/simplecpapi.py where I didn't want the full SDK, but didn't want to repeat lots of code either.

Re: python api script

Nüüül — Tue, 24 Jan 2023 09:37:24 GMT

Hello,

i believe you mixed up the different ways to leverage the api.

"add-access-rule" uses web service

"add access-rule" uses the mgmt cli (which is calling API too but is called via cli at management server)

you can switch between them in the documentation - see attached screenshot.
When you are logging in into the API, a session id is generated and sent back to you as response. This session id you will need to add at the following request´s header.

Example for callin web API with SDK:

with APIClient(client_args) as client: # If Error occurs due to fingerprint mismatch if client.check_fingerprint() is False: #output_text.update({"Message":"Could not get the server's fingerprint - Check connectivity with the server."}) print("UNKNOWN! Logging into SMS not successful! Please troubleshoot/debug script! "+str(output_text)) raise SystemExit() # login to server: login_res = client.login(api_user, api_pwd)

so:

documentation is acurate - when using the correct way to call the api

SDK simplifies things like session handling - to understand all the things, you can manually write https requests towards the API with correct headers and so.

in case you need help, feel free to reach out

Re: python api script

Roberts12 — Tue, 24 Jan 2023 11:50:38 GMT

Thank you for the explanation! if you have more examples to share it would be appreciated.
I can run the example scripts from the github repo, but when I extend the script with more functions and more API calls I get this error message:
Failed to add the access-rule: '1', Error:
code: generic_err_wrong_session_id
message: Wrong session id [XwGUCgAvdFDB2_8vTN2KBXV-XCynk4Zp12Q]. Session may be expired. Please check session id and resend the request

Re: python api script

Nüüül — Tue, 24 Jan 2023 12:02:43 GMT

I wrote some scripts leveraging the SDK - like: https://github.com/leinadred/CP_IPS-Update-Monitoring4Nagios or https://github.com/leinadred/py_cp-updatable-objects

difficult to say, without being able to see your script. but i think you went out of the "with" procedure, so SDK logged you out. As API is "opened" like a file, with is closing it (and logs off the connection) when leaving the file.

So your "working procedures" will have to be inside of the "opened file"

in https://github.com/leinadred/py_cp-updatable-objects from line 59 (res_repo =....)