PAM API example to create device with device group memberships

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Threat Analytics for PAM

Issue/Introduction

Rest API call "POST/api.php/v1/devices.json" can be used to create new devices in PAM, but the details on the Settings > API Doc page for this resource are not very clear. Can an example be provided that includes membership to existing device groups?

Environment

CA Privileged Access Manager (PAM) with Rest API enabled.

Cause

Expanding a resource on the Settings > API Doc page provides a body template with values "null" that doesn't show the required format for parameter values. In most cases the Description text on the right doesn't provide valid examples either.

Resolution

Here is a sample body that creates a Linux device with access method SSH and as a member of the two devices groups with IDs 3001 and 86001. Instructions on how to obtain the ID for a device group are provided in section Additional information.

{
"description":"RH 10 Device created by Rest API",
"deviceName":"rh10device.example.com",
"domainName":"rh10device.example.com",
"location":"Lab 12",
"os":"Linux",
"deviceAccessMethods":[
{"customName": null, "port": "22", "taskProperty": "x11forwarding", "type": "SSH" }
],
"deviceGroupMembershipIds":[3001,86001],
"typeAccess": "t",
"typePassword": "t",
"typeA2A": "f",
"provisionType": "Local"
}

Additional Information

Device group IDs are obtained using Rest API resource "GET /api.php/v1/deviceGroups.json". Use the groupName filter to get information on specific groups, or run without filter to get information on all groups with a single call. In the latter case set the "limit" parameter to "0" to get all. The ID of each group is returned as parameter "groupId".