topic Re: GAIA API beginner questions in API / CLI Discussion

GAIA API beginner questions

S_E_ — Mon, 02 Jun 2025 13:24:21 GMT

Access to the API server is forbidden. Can't see why.

API Status:
---------------------
Build: cp991255299
Uptime: 28 days, 13:19:31.071350
Current Sessions: 0
Latest Version: 1.8

Processes:

Name State PID
---------------------------------
GAIA_API Started 45144
GAIA_API_DOCS Started 45143
APACHE Started 45210
CONFD Started 46116
CLISHD Started 6752
CELERY Started 45142
REDIS Started 17073

Port Details:
-------------------
APACHE Gaia Port: 443

--------------------------------------------
Overall API Status: Started

FW81.20> show rba user apiadmin
User
apiadmin
access-mechanism Gaia-API
access-mechanism CLI
access-mechanism Web-UI
role adminRole

[Expert@FW81.20:0]# mgmt_cli login user apiadmin password <REMOVED> > id.txt
[Expert@FW81.20:0]# cat id.txt
message: "Error 403. Access to the API server is forbidden. Please check the Management API blade
settings to make sure that the server is allowed to accept requests from this IP address.
"code: "generic_error"

Management API Advanced is set to 'All IP'

Thanks,
Regards

Re: GAIA API beginner questions

Bob_Zimmerman — Mon, 02 Jun 2025 14:13:20 GMT

The management API and the Gaia API are two different things. The management API lets you read and change rules and objects (stuff you would do in SmartConsole). Only management servers run the management API.

The Gaia API lets you read and change OS-level things like interfaces and routes.

Is this system a management server, a gateway, or both?

What properties are you trying to read or change?

Re: GAIA API beginner questions

S_E_ — Mon, 02 Jun 2025 14:20:58 GMT

Hi,

yes, with management API on MDS, I'm a little bit familiar.

Now, for GAIA API (firewall cluster) i simply try to get the routing list (static and BGP) via an API call.

My test have been on the active firewall.

Later, I would prefer to run the call from the MGMT to fetch the routes of the GW.

Regards

Re: GAIA API beginner questions

Bob_Zimmerman — Mon, 02 Jun 2025 15:10:42 GMT

To use mgmt_cli to interact with the Gaia API, you need to use the --context option, like so:

[Expert@DallasticXL-s01-01:0]# sessionCookie=$(mktemp) [Expert@DallasticXL-s01-01:0]# mgmt_cli -f json --context gaia_api login user admin password '1qaz!QAZ' >"${sessionCookie}" [Expert@DallasticXL-s01-01:0]# mgmt_cli -f json -s "${sessionCookie}" show routes { "from": 1, "member-id": "1_1", "objects": [ { "active-age": 6549591, "address": "0.0.0.0", "age": 6549591, "mask-length": 0, "next-hop": { "gateways": [ { "address": "10.0.1.1", "interface": "wrp0" } ] }, "protocol": "Static" }, { "address": "10.0.1.0", "mask-length": 24, "next-hop": { "interface": "wrp0" }, "protocol": "Connected" }, { "address": "127.0.0.0", "mask-length": 8, "next-hop": { "interface": "lo" }, "protocol": "Connected" }, { "address": "192.0.2.0", "mask-length": 24, "next-hop": { "interface": "Sync" }, "protocol": "Connected" } ], "to": 4, "total": 4, "virtual-system-id": 0 }

Re: GAIA API beginner questions

Timothy_Hall — Mon, 02 Jun 2025 17:46:44 GMT

What Bob said about the --context gaia_api option. The Gaia API is nicely covered in the R81.20 version of the Check Point Certified Automation Specialist (CCAS) course which is available worldwide from Check Point ATCs. A tip included in the class is the location of the file /var/log/gaia_api_server.log which may need to be consulted if you can't seem to figure out what is wrong with an API call you are making, as sometimes the error message you get is not very helpful.

Re: GAIA API beginner questions

S_E_ — Tue, 03 Jun 2025 06:20:34 GMT

hm,

still same error message.

Regards

[FW81.20:0]# mgmt_cli -f json -s "${sessionCookie}" show routes
Failed to parse login output file [/tmp/tmp.8sDz9rumHP]
[FW81.20:0]# more /tmp/tmp.8sDz9rumHP
{
"code" : "generic_error",
"message" : "Error 403. Access to the API server is forbidden.
Please check the Management API blade settings to make sure that the server is allowed to accept requests from this IP address."

Re: GAIA API beginner questions

S_E_ — Tue, 03 Jun 2025 06:23:53 GMT

Thanks, It looks like that I make something fundamentely wrong:

more /var/log/gaia_api_server.log
03/06/25 00:26:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 01:16:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 02:06:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 02:56:30: Thread-1: server_util.udsListener: INFO: Internal request for 'status'
03/06/25 02:56:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 03:46:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 04:36:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 05:26:59: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 06:17:00: Dummy-2: sessions_manager: INFO: roles cache updated
03/06/25 06:17:36: MainThread: server_util.udsListener: INFO: remote_addr IP = 127.0.0.1
03/06/25 06:17:36: MainThread: server_util.udsListener: INFO: Request for endpoint /login [method: POST], for source 127.0.0.1, FAILED [duration 0ms]

Regards

Re: GAIA API beginner questions

Alex- — Tue, 03 Jun 2025 07:07:04 GMT

If you make the calls from the machine itself, you likely need to add 127.0.0.1 as allowed-client.

{ "api-server-version": "1.8", "last-login-was-at": { "iso-8601": "2024-09-25T13:39+2.00.0", "posix": 1727264371178 }, "read-only": false, "session-timeout": 600, "sid": "[sid]", "url": "https://127.0.0.1:443/gaia_api" }

Re: GAIA API beginner questions

S_E_ — Tue, 03 Jun 2025 07:36:37 GMT

awkward,

a lot of entries in allowed-list but no 127.0.0.1

Now it works,

Both with session-id or session variable.

Thanks!!!

Re: GAIA API beginner questions

PhoneBoy — Tue, 03 Jun 2025 17:29:47 GMT

What is configured in cpconfig in terms of allowed IP addresses?
This also applies to API requests.

Re: GAIA API beginner questions

S_E_ — Fri, 20 Jun 2025 08:18:45 GMT

Hi,

now I run in the next issue. It looks like that the output is limited to 50. (API 1.5, R81.10)

Newer API version seems to have a limit of 200.

However, Is there any idea to increase that to 2000 or more?

Or is gaia_api the completely wrong approach to read the routing table if routes > 2000.

Thanks

Regards

Re: GAIA API beginner questions

Daniel_Kuhl1 — Fri, 20 Jun 2025 09:39:25 GMT

Hi, have you tried to specify a limit in the request body with v1.5? Then you could use a offset in the request body to query the next bunch of results. You can build a script with a loop to request all results query by query, add it to a variable, and write it to a file after you received all data or whatever you want to do with the data.

Re: GAIA API beginner questions

S_E_ — Fri, 20 Jun 2025 10:16:55 GMT

Hi,

I tried with 2 different gateways (R81.10 & R81.20).

But I could not manage to accept the Limit parameter.

[does not work]

[Expert@fw1]# mgmt_cli show routes limit 200 --version 1.7 --context gaia_api -f json -s "${sessionCookie}"
{
"code": "generic_error",
"errors": "unsupported operand type(s) for +: 'int' and 'str'",
"message": "General Exception"
}

[works]

[Expert@fw1]# mgmt_cli show routes --context gaia_api -f json -s "${sessionCookie}"
{
"from": 1,
"objects": [
{
"address": "0.0.0.0",
"age": 4242532,

Regards

Re: GAIA API beginner questions

PhoneBoy — Mon, 23 Jun 2025 19:20:16 GMT

Usually limit is also used with the offset parameter.
The fact you're not specifying it in your command might have exposed a bug 🙂

Try mgmt_cli show routes limit 200 offset 0 --version 1.7 --context gaia_api -f json -s "${sessionCookie}"

Re: GAIA API beginner questions

PhoneBoy — Mon, 23 Jun 2025 19:24:28 GMT

Also, you may want to double check the supported API versions with mgmt_cli show api-versions
To update to the latest, see: https://support.checkpoint.com/results/sk/sk143612

Re: GAIA API beginner questions

S_E_ — Tue, 24 Jun 2025 06:18:40 GMT

Hi,

Thanks

I tested with appliances with API versions 1.6 and 1.7. Both do not work. Seems liek a bug.

(However TAC confirmed issues)

With gaia_api 1.8 it does work.

Thanks a lot for help

Regards