RestAPI answers "The data is invalid for selected url" FortiManager-300E v.5.4.4

[alexander_budnikov]

Hello,  I am trying to modify a policy by calling the rest API but one of devices sends following response (another one works fine):

{ "id": 1, "result": [ { "status": { "code": -10, "message": "The data is invalid for selected url" }, "url": "\/pm\/config\/adom\/SOMEADOM\/pkg\/SOMEPKG\/firewall\/policy" } ] }

SOMEADOM, SOMEPKG - placeholders.

The device is - FortiManager-300E v.5.4.4 GA build 1225 .

1) First of all after the login request I tried to lock this package  "SOMEPKG". Request:

curl -v -XPOST -H "Content-type: application/json" -d '{
 "method": "exec",
 "params": [ {
 "url": "/dvmdb/adom/SOMEADOM/workspace/lock/pkg/SOMEPKG"
 } ],
 "session": "p51==",
 "verbose": 1,
 "id": 1
 }' 'https://11.22.33.44:443/jsonrpc' -k

Response:

* About to connect() to 11.22.33.44 port 443 (#0)
* Trying 11.22.33.44... connected
* Connected to 11.22.33.44 (11.22.33.44) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* warning: ignoring value of ssl.verifyhost
* skipping SSL peer certificate verification
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: E=support@fortinet.com,CN=COMMON_NAME,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US
* start date: Dec 31 01:34:02 2236 GMT
* expire date: Jan 22 02:13:07 1668 GMT
* common name: COMMON_NAME
* issuer: E=support@fortinet.com,CN=support,OU=Certificate Authority,O=Fortinet,L=Sunnyvale,ST=California,C=US
> POST /jsonrpc HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 11.22.33.44
> Accept: */*
> Content-type: application/json
> Content-Length: 248
>
< HTTP/1.1 200 OK
< Date: Thu, 20 Dec 2018 10:11:56 GMT
< Server: Apache
< X-Frame-Options: SAMEORIGIN
< Vary: Accept-Encoding
< X-UA-Compatible: IE=Edge
< X-XSS-Protection: 1; mode=block
< Transfer-Encoding: chunked
< Content-Type: application/json
<
* Connection #0 to host 11.22.33.44 left intact
* Closing connection #0
{ "id": 1, "result": [ { "status": { "code": -3, "message": "Object does not exist" }, "url": "\/dvmdb\/adom\/SOMEADOM\/workspace\/lock\/pkg\/SOMEPKG" } ] }You have new mail in /var/spool/mail/root
[root@some_host ~]#

2) Then I tried to lock the entire adom Request:

curl -v -XPOST -H "Content-type: application/json" -d '{
 "method": "exec",
 "params": [ {
 "url": "/pm/config/adom/SOMEADOM/_workspace/lock"
 } ],
 "session": "p51==",
 "verbose": 1,
 "id": 1
 }' 'https://11.22.33.44:443/jsonrpc' -k

Response:

* About to connect() to 11.22.33.44 port 443 (#0)
* Trying 11.22.33.44... connected
* Connected to 11.22.33.44 (11.22.33.44) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* warning: ignoring value of ssl.verifyhost
* skipping SSL peer certificate verification
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: E=support@fortinet.com,CN=COMMON_NAME,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US
* start date: Dec 20 00:21:02 2111 GMT
* expire date: Jan 13 23:34:07 2131 GMT
* common name: COMMON_NAME
* issuer: E=support@fortinet.com,CN=support,OU=Certificate Authority,O=Fortinet,L=Sunnyvale,ST=California,C=US
> POST /jsonrpc HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 11.22.33.44
> Accept: */*
> Content-type: application/json
> Content-Length: 241
>
< HTTP/1.1 200 OK
< Date: Thu, 10 Dec 2354 20:33:36 GMT
< Server: Apache
< X-Frame-Options: SAMEORIGIN
< Vary: Accept-Encoding
< X-UA-Compatible: IE=Edge
< X-XSS-Protection: 1; mode=block
< Transfer-Encoding: chunked
< Content-Type: application/json
<
* Connection #0 to host 11.22.33.44 left intact
* Closing connection #0
{ "id": 1, "result": [ { "status": { "code": 0, "message": "OK" }, "url": "\/pm\/config\/adom\/SOMEADOM\/_workspace\/lock" } ] }You have new mail in /var/spool/mail/root

I succeed.  

3) Then I tied to apply the changes Request:

curl -v -XPOST -H "Content-type: application/json" -d '{
 "method": "update",
 "params": [ {
 "url": "/pm/config/adom/SOMEADOM/pkg/SOMEPKG/firewall/policy",
 "data": [ {
 "policyid":69,
 "status":1,
 "comments":"FF #2209 FF #3885 test change",
 "action":1,
 "srcintf":["port2"],
 "dstintf":["DMZ-SOMEPKG-IN"],
 "srcaddr":["A__INTERNET/DMS_PE","A__INTERNET/DMS_PE_1"],
 "dstaddr":["A_Hb-Mut-Prod-Rev-Oper_621/ESB-WSO_0010"],
 "service":["HTTPS-8443","HTTP"],
 "devices":[""]
 } ]
 } ],
 "verbose": 1,
 "session": "p51==",
 "id": 1
 }' 'https://11.22.33.44:443/jsonrpc' -k

Response:

* About to connect() to 11.22.33.44 port 443 (#0)
* Trying 11.22.33.44... connected
* Connected to 11.22.33.44 (11.22.33.44) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* warning: ignoring value of ssl.verifyhost
* skipping SSL peer certificate verification
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: E=support@fortinet.com,CN=COMMON_NAME,OU=FortiManager,O=Fortinet,L=Sunnyvale,ST=California,C=US
* start date: Dec 14 00:37:02 2336 GMT
* expire date: Jan 12 03:14:07 2133 GMT
* common name: COMMON_NAME
* issuer: E=support@fortinet.com,CN=support,OU=Certificate Authority,O=Fortinet,L=Sunnyvale,ST=California,C=US
> POST /jsonrpc HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 11.22.33.44
> Accept: */*
> Content-type: application/json
> Content-Length: 698
>
< HTTP/1.1 200 OK
< Date: Thu, 20 Dec 2018 10:42:35 GMT
< Server: Apache
< X-Frame-Options: SAMEORIGIN
< Vary: Accept-Encoding
< X-UA-Compatible: IE=Edge
< X-XSS-Protection: 1; mode=block
< Transfer-Encoding: chunked
< Content-Type: application/json
<
* Connection #0 to host 11.22.33.44 left intact
* Closing connection #0
{ "id": 1, "result": [ { "status": { "code": -10, "message": "The data is invalid for selected url" }, "url": "\/pm\/config\/adom\/SOMEADOM\/pkg\/SOMEPKG\/firewall\/policy" } ] }

I hope you will be able to help me. I need to know what is the cause and how to fix it or mayby some suggestions?

Thanks, Alex.