{"id":8395,"library":"pan-python","title":"Pan-Python","description":"Pan-Python is a multi-tool set for interacting with Palo Alto Networks PAN-OS, Panorama, WildFire, and AutoFocus platforms. It provides a powerful, low-level Python interface to the PAN-OS and Panorama XML API, as well as interfaces for WildFire, AutoFocus, and licensing APIs. The library is actively maintained, with its current version being 0.25.0, and receives regular updates.","status":"active","version":"0.25.0","language":"en","source_language":"en","source_url":"https://github.com/kevinsteves/pan-python","tags":["Palo Alto Networks","PAN-OS","Panorama","WildFire","AutoFocus","network","security","API","firewall","automation","XML API"],"install":[{"cmd":"pip install pan-python","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"symbol":"PanXapi","correct":"from pan.xapi import PanXapi"},{"symbol":"PanWFapi","correct":"from pan.wfapi import PanWFapi"},{"symbol":"PanAFapi","correct":"from pan.afapi import PanAFapi"},{"symbol":"PanLicapi","correct":"from pan.licapi import PanLicapi"}],"quickstart":{"code":"import os\nfrom pan.xapi import PanXapi, PanXapiError\n\nhostname = os.environ.get('PAN_OS_HOSTNAME', 'your_firewall_ip')\napi_key = os.environ.get('PAN_OS_API_KEY', 'your_api_key')\n\nif not hostname or not api_key:\n    print(\"Please set PAN_OS_HOSTNAME and PAN_OS_API_KEY environment variables.\")\n    exit(1)\n\ntry:\n    # Initialize the XAPI connection\n    xapi = PanXapi(hostname=hostname, api_key=api_key)\n\n    # Example 1: Execute an operational command (show system info)\n    print(\"\\n--- Showing System Info ---\")\n    xapi.op(cmd='show system info', cmd_xml=True)\n    if xapi.status == 'success':\n        print(xapi.xml_result())\n    else:\n        print(f\"Error fetching system info: {xapi.status}: {xapi.status_detail}\")\n\n    # Example 2: Edit a configuration element (e.g., disable a security rule)\n    # Note: This is a configuration change and requires appropriate permissions.\n    # For a real scenario, ensure rule 'rule7' exists and handle commit.\n    print(\"\\n--- Attempting to disable 'rule7' ---\")\n    xpath = \"/config/devices/entry/vsys/entry/rulebase/security/rules/entry[@name='rule7']/disabled\"\n    element = \"<disabled>yes</disabled>\"\n    # Example: Uncomment and adjust for your environment\n    # xapi.edit(xpath=xpath, element=element)\n    # if xapi.status == 'success':\n    #     print(\"Rule 'rule7' disabled. Remember to commit changes.\")\n    # else:\n    #     print(f\"Error disabling rule: {xapi.status}: {xapi.status_detail}\")\n\nexcept PanXapiError as e:\n    print(f\"PanXapi Error: {e}\")\nexcept Exception as e:\n    print(f\"An unexpected error occurred: {e}\")","lang":"python","description":"This quickstart demonstrates how to connect to a Palo Alto Networks device (Firewall or Panorama) using `pan.xapi.PanXapi` and execute an operational command (`show system info`). It also includes a commented example for a configuration edit. Ensure you have the hostname/IP and an API key configured as environment variables for secure access."},"warnings":[{"fix":"Upgrade your Python environment to version 3.7 or later.","message":"Python 2 support was entirely removed starting from v0.19.0. Pan-Python now strictly requires Python 3.7 or newer.","severity":"breaking","affected_versions":">=0.19.0"},{"fix":"Initialize `PanXapi` with either `api_key` or `api_username` and `api_password`, but not both simultaneously.","message":"When initializing `PanXapi`, providing both `api_key` and `api_username`/`api_password` is redundant. It is recommended to use only the `api_key` for authentication for simplicity and often better security practices.","severity":"gotcha","affected_versions":"All"},{"fix":"When importing a file as bytes, ensure to pass a dummy string for the `filename` argument, e.g., `xapi.import_file(filename='temp_file.txt', file=your_bytes_data)`.","message":"The `pan.xapi.PanXapi.import_file()` method, when used with `file` as bytes, requires a `filename` argument, even if it's a dummy string, as it's a required parameter.","severity":"gotcha","affected_versions":">=0.25.0"},{"fix":"Reduce the `nlog` value to retrieve fewer log entries at a time or implement pagination/batching to manage memory usage.","message":"Using a large `nlog` value in `pan.xapi.PanXapi.log()` can lead to memory exceptions as the entire XML document is loaded into memory by the `ElementTree` module.","severity":"gotcha","affected_versions":"All"},{"fix":"For object-oriented interaction and higher-level configuration, consider using `pan-os-python`. For direct XML API interaction or specific commands not covered by `pan-os-python`, `pan-python` is appropriate.","message":"`pan-python` provides a low-level XML API interface, while `pan-os-python` is an object-oriented SDK. Ensure you are using the correct library for your automation needs; `pan-os-python` typically offers a more abstract and user-friendly experience for configuration tasks.","severity":"gotcha","affected_versions":"All"}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Verify the API key is correct and ensure the user associated with the key has the necessary administrative roles and permissions on the PAN-OS device or Panorama.","cause":"Incorrect API key or insufficient permissions for the API user on the Palo Alto Networks device.","error":"pan.xapi.PanXapiError: (403, 'Forbidden', None, None)"},{"fix":"Install the package using `pip install pan-python` in your active Python environment. If using a virtual environment, ensure it is activated.","cause":"The `pan-python` library is not installed, or the Python environment where it was installed is not active.","error":"ModuleNotFoundError: No module named 'pan'"},{"fix":"Consult the `pan-python` documentation for available methods and attributes on `PanXapi` and other classes. If attempting a higher-level operation, consider if `pan-os-python` would be more appropriate.","cause":"Attempting to call a method or access an attribute that does not exist on the `PanXapi` object, or mistyping a valid method name. This often happens when mixing `pan-python` (low-level) with `pan-os-python` (object-oriented SDK) calls.","error":"AttributeError: 'PanXapi' object has no attribute 'some_method'"},{"fix":"Inspect the XML response structure from the device using `xapi.xml_result()` to confirm the exact key names. Use `.get('key_name', default_value)` for safer dictionary access.","cause":"Attempting to access a dictionary key that does not exist in the XML API response or a data structure derived from it.","error":"KeyError: 'some_key'"}]}