The input for the PUT /api.php/v1/devices/{id}/terminalSettings api is not validated

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Using API PUT /api.php/v1/devices/36001/terminalSettings is giving  a return code http200 (that means successful) even when the body contains a parameter which is not of the correct format, for instance with the following request body :

{

  "ktaBgColor": "RUBBISH"

}

same happens for item  'Character Encoding' that you can put whatever text.

This causes the target device to become unusable. Specifically access sessions to the device will not work.

Environment

PAM 4.2.x and 4.3

Cause

In all PAM releases available as of December 2025 the settings published via this Rest API call are not validated.

Resolution

The terminal settings are validated when using the PAM GUI to update a device.

We recommend to configure a reference device with the desired terminal settings using the GUI (Graphical User Interface), retrieve the settings for that device, and then use the API call to set them for other devices. This way you can be sure that the settings you publish are valid.