Package: panapi
panapiThis is a lightweight Python SDK designed to interact with Palo Alto Networks Cloud Management API.  It consists of an object-oriented library that simplifies OAuth 2.0 session estalishment, access token validation, and automatic access token refresh.  Each configuration API endpoint is represented as unique object instances that provide a common set of create, read, update, delete, and list functions.FeaturesOAuth 2.0 session management (subclassed from requests_oauthlib.Session)Supports credential config file (~/panapi/config)JSON Web Key Set (JWKS) retrievalJWT access token decoding and validationCommon create, read, update, delete, and list methods for all config objectsAutomatic and transparent access token refreshInstallationUpgrade to the latest pippip install --upgrade pipInstall using pip$ pip install panapiUpgrade to the latest version$ pip install --upgrade panapiConfigurationThe Cloud Management API utilizes OAuth 2.0 to authenticate and authorize incoming API calls.  This requires requesting an access token from an Authorization Server.  The credentials needed to request an access token can be defined in a configuration located at$HOME/.panapi/config.yml.---
#
# my-tenant
#
client_id: apitest@1808050139.iam.panserviceaccount.com
client_secret: feea5864-f557-11ec-b939-0242ac120002
scope: tsg_id:1808050139
token_url: https://auth.apps.paloaltonetworks.com/am/oauth2/access_tokenUsageThe following is a brief overview of how to use thepan-api-pythonSDK.  For comprehensive details on its usage, please refer to the documentationhere.Import the modulesThe entire SDK can be imported into your project.importpanapiSpecific modules can be imported as well.frompanapi.configimportsecurity,networkIndividual classes can also be imported.frompanapi.config.networkimportRemoteNetwork,IKEGateway,IPSecTunnelEstablish the OAuth 2.0 sessionInstantiate thePanApiSessionhandler and authenticate to the Authorization Server.session=panapi.PanApiSession()session.authenticate()If successful, the access token will become an attribute of thePanApiSessioninstance.session.access_tokenToken validation is done automatically with each API call using thepan-api-pythonSDK.  However, manual validation of the JWT token claims and cryptographic signature can be done as well.session.is_validWorking with configuration objectsInstantiate a new configuration object.addr1=panapi.config.objects.Address(folder='Shared',name='server1',ip_netmask='10.0.100.150',description='App server 1',tags=['production'])Create the new configuration on the cloud management tenant.addr1.create(session)The HTTP status code resulting fromPanApiSessionAPI transactions attached to the session instance.result=session.status_codeRetrieve a configuration object by name.gw1=panapi.config.network.IKEGateway(folder='Remote Networks',name='Seattle-GW')Display the JSON payload of a configuration object.json.dumps(gw1.payload,indent=4)Update elements of a configuration object.rule=panapi.config.security.SecurityRule(folder='Shared',named='Allow monitoring')rule1.read(session)rule1.applications=['snmpv2','snmpv3']rule1.description='Allow SNMPv2 and v3 from NOC'rule1.update(session)Delete a configuration from the cloud management tenant.id1=panapi.config.identity.SAMLProfile(folder='Shared',name='AD-SAML')id1.read(session)id1.delete(session)