REST API call for CA PAM does not retrieve the expected target account

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The CA PAM REST API may be used to retrieve the properties of a device, its associated target applications and target accounts.

This typically starts with Rest API call /api.php/v1/devices.json, passing as parameter the device name, in this case "server.example.com", which returns details of the device:

{
  "totalRows": "1",
  "devices": [
    {
      "deviceId": "60001",
      "deviceName": "server.example.com",
      "domainName": "server.example.com",
      "description": "",
      "os": "Other",

 

The response includes the ID of the device, in this case 60001, which may be used to get the list of target applications associated with the device by using REST API call /api.php/v1/devices.json{id}/targetApplications.

For a successful call the output will look similar to the following and include the IDs of the target applications:

[
  {
    "id": "52001",
    "applicationName": "SSH-server.example.com",
    "applicationType": "vmware",
    "description1": "",
    "description2": "",
    "deviceId": 60001,
    "passwordCompositionPolicyId": "1002"
  },
  {
    "id": "51001",
    "applicationName": "SSH-server.example.com-xxx",
    "applicationType": "vmware",
    "description1": "",
    "description2": "",
    "deviceId": 60001,
    "passwordCompositionPolicyId": "1003"
  }
]

To obtain information about target accounts associated with a target application for a specific device, Rest API call /api.php/v1/devices.json{id}/targetApplications/{applicationId}/targetAccounts is used.

But depending on which API key credentials are used for the call, the output may not return the expected list of target accounts, even though they are defined in PAM:

https://mypam.example.com/api.php/v1/devices.json/60001/targetApplications/52001/targetAccounts?sortBy=%2BaccountName&limit=10

returns

[]

and code 200

There is no error, but the response array is empty.

Cause

This is caused by a permissions issue. The output is filtered by the list of accounts the API Key making the call is allowed to access. If it does not have a Credential Management role that includes access to the target accounts in the target application queried, an empty list will be returned.

Resolution

Assign the API Key a Password Management role, and a Credential Manager group that has access to the target accounts that the API Key is expected to see. Since the API Key is associated with a PAM user, in order to do this the corresponding user will have to have at least the same level of privileges and it will have to be assigned the same Credential Management groups as the API Key being used to do the queries.