How To Remove Descriptors Through The API

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A set of devices, target applications, or target accounts have Descriptor 1 and/or Descriptor 2 set and it is required to make them null. When trying to set a descriptor to null through the API, there is a 200 response code but the Descriptor 1 does not change. What is the proper syntax to set a descriptor to null?

For example, the PUT /api.php/v1/devices.json/{id}/targetApplications with the following is being used in an attempt to remove both descriptors. One attempt is using "" and the other is using null.

{
  "id": "404001",
  "applicationName": "API Test Generic App",
  "applicationType": "Generic",
  "description1": "",
  "description2": null,
  "attributes": [],
  "passwordCompositionPolicyId": "0",
  "sshKeyPairPolicyId": null,
  "sshCertificatePolicyId": null
}

But when the GET API call is made afterwards, the application still has both descriptors set.

{
  "id": "404001",
  "applicationName": "API Test Generic App",
  "applicationType": "Generic",
  "description1": "demo1",
  "description2": "demo2",
  "deviceId": 101001,
  "attributes": [],
  "passwordCompositionPolicyId": "0",
  "sshKeyPairPolicyId": null,
  "sshCertificatePolicyId": null
}

Cause

When the Rest API is used to update an existing object in the database, it will put the information from the request body into a new object and loads the existing object for comparison. It goes through the attributes of the new object and if it finds one that's not null and not empty, it will use it to update the existing object. It will skip over null or empty attributes as a precaution to prevent from accidentally making an attribute null that was not included in the PUT API call.

Resolution

When using an API call to update the object and remove a descriptor, set the value to a single space. Below is an example API body that was used in internal testing.

{
  "id": "404001",
  "applicationName": "API Test Generic App",
  "applicationType": "Generic",
  "description1": " ",
  "description2": " ",
  "deviceId": 101001,
  "attributes": [],
  "passwordCompositionPolicyId": "0",
  "sshKeyPairPolicyId": null,
  "sshCertificatePolicyId": null
}