- Products
- Learn
- Local User Groups
- Partners
- More
MVP 2026: Submissions
Are Now Open!
What's New in R82.10?
10 December @ 5pm CET / 11am ET
Announcing Quantum R82.10!
Learn MoreOverlap in Security Validation
Help us to understand your needs better
CheckMates Go:
Maestro Madness
Hi,
I'm trying to read out group memberships for DNS Domain objects using mgmt_cli and API version 1.9.1, but I'm not getting out any 'groups' even for objects that are confirmed used in groups via SmartConsole. This is from a domain in an MDS-system, but "show hosts details-level full show-membership true" works, so I'm assuming this isn't an MDS limitation.
I'm running the command below, referenced from API documentation:
mgmt_cli show dns-domains details-level full show-membership true --session-id $CPAPI_SID -f json
Is it only me or is it a bug?
I don't have an v2+ API to test this on yet.
I'm dreading going through all groups and finding dns-domain objects from there 😛
Thanks!
It accepts the key, but doesn't change anything about the returned data. The objects simply don't get a 'groups' key. You're right, this looks like a bug. It's easy enough to work around by using where-used, though:
mgmt_cli -f json -d <CMA> -r true where-used uid <Object UUID> | jq '."used-directly".objects[].name'
Try without advanced flags and tell us if it makes any difference:
mgmt_cli show dns-domains
I appreciate the help!
I get the first 50 of the DNS Domain objects with your command, but no group memberships of the objects. Below are some tests and comparison to "show hosts".
export CPAPI_SID=$(mgmt_cli -r true login domain <domain> -f json | jq -r '.sid')
# no group memberships of DNS Domain objects
mgmt_cli show dns-domains --session-id $CPAPI_SID
Ex:
- uid: "67ecbdd2-xyz-481b-9711-7a1ad69d8fdb"
name: ".confirmed-member-of-group.example.com"
type: "dns-domain"
domain:
uid: "1e294ce0-xyz-11e3-aa6e-0800200c9a66"
name: "Global"
domain-type: "global domain"
icon: "Objects/domain"
color: "violet red"
# no group memberships of DNS Domain objects
mgmt_cli show dns-domains show-membership true --session-id $CPAPI_SID
# no group memberships of DNS Domain objects
mgmt_cli show dns-domains details-level full show-membership true --session-id $CPAPI_SID
# no group memberships of Host objects
mgmt_cli show hosts show-membership true --session-id $CPAPI_SID
# group memberships of Host objects
mgmt_cli show hosts details-level full show-membership true --session-id $CPAPI_SID
I'm very sure I need "details-level full" to get group membership output.
I saw an invite to a R82 lab, I have try it later on though, I'm on 15% battery >_<.
I did command Val suggested and that worked.
Andy
It accepts the key, but doesn't change anything about the returned data. The objects simply don't get a 'groups' key. You're right, this looks like a bug. It's easy enough to work around by using where-used, though:
mgmt_cli -f json -d <CMA> -r true where-used uid <Object UUID> | jq '."used-directly".objects[].name'
Thank you for tip with where-used and UUID, and confirming that I'm not losing my mind 🙂
I'm sorry that I have not tried the R82 lab yet. Is it worth raising a ticket for the r81.20 API?
Sure. R81.20 is still supported. It behaves the same on R82 jumbo 41, though. That's where I tested.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 4 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Fri 12 Dec 2025 @ 10:00 AM (CET)
Check Mates Live Netherlands: #41 AI & Multi Context ProtocolTue 16 Dec 2025 @ 05:00 PM (CET)
Under the Hood: CloudGuard Network Security for Oracle Cloud - Config and Autoscaling!Fri 12 Dec 2025 @ 10:00 AM (CET)
Check Mates Live Netherlands: #41 AI & Multi Context ProtocolTue 16 Dec 2025 @ 05:00 PM (CET)
Under the Hood: CloudGuard Network Security for Oracle Cloud - Config and Autoscaling!Thu 18 Dec 2025 @ 10:00 AM (CET)
Cloud Architect Series - Building a Hybrid Mesh Security Strategy across cloudsAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY