topic Re: /web_api/add-administrator in API / CLI Discussion

/web_api/add-administrator

Szymon2022 — Fri, 28 Apr 2023 15:21:32 GMT

Hello,

I need some help with web_api request. I m getting error:

{"code": "err_inappropriate_domain_type", "message": "This command can work only on domains of type MDS. Cannot execute it in the current domain (current domain type is Domain)."}

Need to creat new adminstrator account via web_api on Check Point Smart Concole.

My payload looks like:

new_user_data = {'name': test123, 'authentication-method': 'tacacs', 'tacacs-server': 'TACACS-test', 'permissions-profile': {'domain':"System Data", 'profile':'read only all'}, 'ignore-warnings': 'true' }

Using set:

Check Point - Management API reference

R81.10

SmartConsole 81.10.9600.409

Got only one system domain, nothing more.

Using mgmt_cli everything working proper.

mgmt_cli working properly.

mgmt_cli add administrator name "test123" password "test123" must-change-password false email "test@gmail.com" phone-number "1800-800-800" authentication-method "check point password" permissions-profile "read only all" --domain 'System Data' --format json -u xxxxxx-p 'xxxxxxyyyyyy'

Any idea how the payload should looks like to be a proper query on web_api?

Re: /web_api/add-administrator

PhoneBoy — Fri, 05 May 2023 21:01:37 GMT

When you did the login call, did you log into the "System Data" domain?
If not, this API call will fail in the manner described.
Note this should be required on mgmt_cli as well (or at least it was last time I checked).

@Omer_Kleinstern can we make it more explicit in the documentation which API calls can only be executed in the "System Data" domain?
A more informative error message would also be useful.

Re: /web_api/add-administrator

Omer_Kleinstern — Sun, 07 May 2023 08:44:19 GMT

From the description of the add-administrator command:
"This command is available only after logging in to the System Data domain."

Re: /web_api/add-administrator

Bob_Zimmerman — Sun, 07 May 2023 13:09:34 GMT

On a related note, is there a list of all of the API calls which are only available on the System Data domain?

Are there any calls which are available outside System Data but which aren't fully functional?

Re: /web_api/add-administrator

Szymon2022 — Mon, 08 May 2023 09:46:10 GMT

In the past few days I was searching the proper url and proper payload to login in to system data. And I couldnt find it out.

I realised that I need to be login in to the system data first but do not know how to do it.

url = "https://ip4_address/web_api/login"

payload = {

"user": "admin",

"password": "xxx",

"domain":{"name" : "System Data"}

}

Maybe url is not appropriate?

callback:

{
"code" : "generic_err_invalid_syntax",
"message" : "Login request message processing failed"
}

Any suggestions about URL and payload?

Re: /web_api/add-administrator

Szymon2022 — Mon, 08 May 2023 09:47:56 GMT

That's right so how to login in to system data via Web Services (WebAPI)?

Re: /web_api/add-administrator

Jim_Oqvist — Mon, 08 May 2023 12:01:32 GMT

Hi Szymon2022,

There is an example in the API reference guide under the "login" API endpoint

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/login~v1.9%20 > example > "login to domain".

just change the value "domain name" to "System Data"

Request

POST {{server}}/login
Content-Type: application/json

{
  "user" : "aa",
  "password" : "aaaa",
  "domain" : "Domain Name"
}

Re: /web_api/add-administrator

Bob_Zimmerman — Mon, 08 May 2023 12:03:22 GMT

Domain should be a string, not an object. It should contain either the name or the UUID of the domain.

Re: /web_api/add-administrator

Szymon2022 — Mon, 08 May 2023 13:01:27 GMT

Thank you for your suggestion. That was it.

Below the correct query simple example:

url = "https://10.143.99.41:443/web_api/login"

payload = {

"user": "admin",

"password": "xxxx",

"domain":"System Data"

}

headers = {'Content-Type' : 'application/json'}

response = requests.post(url,data=json.dumps(payload), headers=headers, verify=False)

if response.status_code ==200:

sid = response.json()["sid"]

print("Done:",sid)

print(response.text)

else:

print("Error")

print(response.text)

payload_user = {

"name": "test123",

"authentication-method":"tacacs",

"tacacs-server":"TACACS-test",

"permissions-profile":"Read Only All",

}

url3 = "https://10.143.99.41/web_api/add-administrator"

headers2 = {'Content-Type' : 'application/json', "X-chkp-sid": sid}

response = session.post(url3, json=payload_user, headers=headers2, verify=False)

if response.status_code !=200:

print("Error during adding adm.")

print(response.text)

else:

print("Adm has been added")

print(response.text)

Then publish and logout.

Thank You everybody for your support. I spent a lot of time to find the solution. I was close :).

Best regards!!