Add FMC 7.6, 7.7, and 10.0 API support - #107
Conversation
Compares all 368 resource implementations against fmc_oas3_7.4.2.json. Documents 4 critical bugs, 13 wrong-path bugs, 8 unmapped filter/param keys that cause KeyError at runtime, and 20+ missing implementations. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix TID URL builder missing /domain/{domainUUID} (all tid.* calls 404)
- Fix TaxiiConfig collection/discoveryinfo PATH including spurious /{uuid}
- Move IpsecCryptoMap to ravpn container (ftds2svpns has no ipseccryptomaps endpoint)
- Implement Hitcount update() and delete() which were no-ops; fix PATH /{uuid}
- Fix AllowDnsRule/BlockDnsRule: plural path segment + remove /{uuid}
- Fix EbsSnapshot: singular ebssnapshot path segment
- Fix PolicyLock: add /operational/ segment + remove /{uuid}
- Fix Usage: /objects/ -> /object/ typo
- Fix S2sVpnSummary: convert to top-level Resource at /policy/s2svpnsummaries
- Fix PreviewChanges/ValidationResults/DownloadReport/EmailReport/FpInterfaceStatistics/ManagementConvergenceMode: remove /{uuid} from list-only endpoints
- Fix TestUmbrellaConnection: add /operational/ segment
- Fix NatRule: move section from SUPPORTED_FILTERS to SUPPORTED_PARAMS
- Fix ChassisInterface: move operation from SUPPORTED_PARAMS to SUPPORTED_FILTERS
- Fix JobHistory SUPPORTED_FILTERS: device_uuid -> device_uuids
- Add missing FILTERS mapping entries: entity_uuid, parent_entity_types, parent_uuid, query_function, regex_filter, source, step, uuid
- Add search namespace: GlobalSearch, ObjectSearch, PolicySearch, DeviceSearch
- Add object.extendedcommunitylist + override
- Add object.localrealmuser
- Add device.devicerecord.vniinterface and vteppolicy (VXLAN)
- Add device routing: EcmpZone (device + VR level), Ospfv3Route (device level)
- Remove deprecated health.csdac (endpoint removed in FMC 7.4.x)
- Update AUDIT_REPORT.md with new findings and full implementation plan
- Update CHANGELOG.md with all changes, breaking changes, and fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds six new exception classes derived from the FMC REST API ResponseStructure documentation and updates raise_for_status to use them precisely: New exceptions: - BadRequestError — HTTP 400 generic bad request - MethodNotAllowedError — HTTP 405 method not permitted on this resource - ServerError — HTTP 5xx catch-all for server-side failures - RateLimitError — HTTP 429 rate limit (canonical rename of RateLimitException) - ConcurrentRequestError — HTTP 429 when >10 parallel connections from same IP - RateLimitWriteError — HTTP 429 when parallel write operation is blocked Behavioral fixes in raise_for_status: - HTTP 403 now always raises AuthorizationError (previously fell through to GenericApiError if response text did not contain the expected substring) - HTTP 405 now always raises MethodNotAllowedError (same issue) - HTTP 5xx codes beyond 500 now raise ServerError instead of GenericApiError - HTTP 429 response body parsed to distinguish RateLimitWriteError and ConcurrentRequestError from the base RateLimitError Backward compatibility: - RateLimitException preserved as an alias for RateLimitError — existing code catching RateLimitException continues to work without modification - The retry decorator now references the canonical RateLimitError name but catches all three 429 sub-types via Python's subclass resolution Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds 29 new resource classes and one new method covering all endpoints introduced in FMC 7.6, verified against OAS3 7.6.5. New templates/ namespace (templates.devicetemplate and children): association, defaultmodelmapping, modelmapping, objectoverride, templateinterface, templatevariable, vpnsetting, supporteddevicemodel, plus apply() and generate() operational methods on DeviceTemplate. New resources across existing namespaces: - analysis.identifieduser (GET, DELETE) - chassis.switch_mode_readiness_check() method - device.ltpdevicerecord, device.bulkregistration, device.downloadsamplecsv - health.event - object.macaddresspool (+override), object.samlrealmuserandgroup, object.variable, object.downloadrealm - object.operational.realmstatus, object.operational.testrealm - troubleshoot.cpuprofiler.module, troubleshoot.snortprofiler.rule Updated policy.healthpolicy to support CREATE, UPDATE, DELETE (7.6+). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New endpoints and write-operation unlocks for FMC 7.7.0: - OSPFv2/v3 routing write ops (create/update/delete) for device and virtual-router routing resources - Device certificate resources (Certificate, CertificatesExportData, ManageCertificate) and devicerecord.operational.outofbandchange - health.aggregatemetric cross-container list endpoint - integration.aiops sub-namespace (AiConfiguration, TsdbUpload, TsdbUploadStatus) and integration.cloudintegration - object.certenrollment.override, object.serviceaccessobject (+override) - policy.ftdplatformsettingspolicy children: bannersetting, eventlist, sshaccesssetting - policy.accesspolicy.securityintelligencepolicy update support - troubleshoot.radkit sub-namespace with radkit.service Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New endpoints for FMC 10.0.0: - analysis.filter — full CRUD - device.bulkcommand — cross-device bulk command (POST) - device.devicerecord.universalzerotrustsetting — GET/UPDATE - integration: ftdcloudstatus (GET), metricconfiguration (GET/POST), splunkprofile (full CRUD) - policy.accesspolicy: advancedloggingsetting and evesetting (GET/UPDATE) - policy.universalzerotrustpolicy (GET/UPDATE) with universalzerotrustrule (full CRUD) - policy.dnspolicy: write ops + new dnsrule child (full CRUD) - policy.identitypolicy: write ops + identitycategory and identityrule children (full CRUD) - policy.decryptionpolicy.standardmodeconfiguration (GET/UPDATE) - policy.ftdplatformsettingspolicy.externalauthsetting (GET/UPDATE) - updates namespace: contentupdate, contentupdateoperation, deviceupgradeinfo - user.externalauth sub-namespace: externalauth, authconfigobject, ldapconfigobject, radiusconfigobject, and three operational endpoints - troubleshoot.packettracer.pcapdetail (GET/POST) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add fmc_oas3_7.6.5/7.7.12/10.0.1 to gen_docstrings.py's spec lookup; it was still pinned to 7.2.5/7.3.1/7.4.2, so new resources' docstrings were hand-written and had several incorrect operationId values. Regenerated docstrings for affected classes (device.certificate, device.managecertificate, integration.aiops.*, integration.ftdcloudstatus, integration.cloudintegration, policy.identitypolicy.identitycategory/rule, troubleshoot.radkit.service, etc.) and picked up several previously undocumented classes as a side effect. - Add missing SUPPORTED_FILTERS/get()/delete() overrides to analysis.IdentifiedUser, with matching entries in mapping.FILTERS. - Restore alphabetical import/attribute order in integration, policy, and device.devicerecord namespaces, broken by the 7.7/10.0 additions. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Regenerate the namespace tree via gen_tree.py to include all resources added for FMC 7.6, 7.7, and 10.0, and bump the stated version coverage from 7.4.0 to 10.0.0. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
# Conflicts: # fireREST/fmc/policy/accesspolicy/operational/hitcounts/__init__.py
| @@ -1,26 +0,0 @@ | |||
| from fireREST.defaults import API_RELEASE_730 | |||
There was a problem hiding this comment.
Why this one is getting removed? If it was supported at some point by API, I'd assume it should stay?
There was a problem hiding this comment.
Verified against the OAS3 specs in this repo: /health/csdac (getCSDACStatus/createCSDACStatus) exists in the 7.3.1 spec but is completely absent from 7.4.2, 7.6.5, 7.7.12, and 10.0.1. Cisco genuinely dropped this endpoint starting with FMC 7.4, so the removal is correct — kept as-is.
| @@ -1,9 +1,24 @@ | |||
| from fireREST.defaults import API_RELEASE_720 | |||
There was a problem hiding this comment.
Isn't this sitting in a wrong place in directory structure? If we mimic the API placement, then this should go direcly under policies?
endpoint: /policy/s2svpnsummaries
There was a problem hiding this comment.
Good catch, you're right. The resource was already wired as a top-level attribute on Policy (self.s2svpnsummary), never nested under FtdS2sVpn — only the directory/import path was left under ftds2svpn/. Moved fireREST/fmc/policy/ftds2svpn/s2svpnsummary/ to fireREST/fmc/policy/s2svpnsummary/ and updated the import in policy/__init__.py to match. Also fixed the README supported-operations tree, which had the same stale nesting.
|
|
||
|
|
||
| class RateLimitError(GenericApiError): | ||
| """HTTP 429 — API rate limit exceeded (more than 120 GET requests/min from a single IP)""" |
There was a problem hiding this comment.
This rate limit is version specific, so may get higher. Also I believe this will also trigger on maximum connections.
There was a problem hiding this comment.
Agreed, that number wasn't safe to hardcode. Reworded to "HTTP 429 — API rate limit exceeded (exact threshold varies by FMC version)" and dropped the specific figure. ConcurrentRequestError remains the distinct case for max-connections.
|
|
||
|
|
||
| class RateLimitWriteError(RateLimitError): | ||
| """HTTP 429 — parallel write operation blocked (only one PUT/POST/DELETE per user at a time)""" |
There was a problem hiding this comment.
Is it per user or this is a general restriction?
There was a problem hiding this comment.
Couldn't confirm the exact scope (per-IP vs per-user) or the specific numbers against any spec/doc in this repo, so I removed the unverified claims rather than guess. Docstrings now just say "HTTP 429 — too many concurrent connections" and "HTTP 429 — a parallel write operation was blocked".
| @@ -0,0 +1,461 @@ | |||
| #!/usr/bin/env python3 | |||
There was a problem hiding this comment.
Do we need this file in repo?
There was a problem hiding this comment.
No, removed it from version control (it's a dev-only audit script, not used by the package). Also added it to .gitignore so it doesn't get re-added.
| @@ -0,0 +1,659 @@ | |||
| # fireREST API Audit Report | |||
There was a problem hiding this comment.
Do we need this file in repo?
There was a problem hiding this comment.
No, removed it from version control along with audit_api.py (dev-only artifact; still referenced historically in .claude/commands/firerest.md but not needed in the repo). Added it to .gitignore too.
|
|
||
| ## New | ||
|
|
||
| * Added granular HTTP exception types to `fireREST.exceptions` based on the FMC ResponseStructure: |
There was a problem hiding this comment.
1.3.0 is already out. Move this to new Unreleased section.
There was a problem hiding this comment.
You're right — confirmed v1.3.0 is already tagged and released with different content (just the prefilterpolicy rename + hitcount fix). This branch had renamed the "Unreleased" header to "1.3.0 [2026-06-12]" and merged all of this PR's new content into that already-released version. Restored a proper "Unreleased" section on top for this PR's changes, and verified the restored 1.3.0 section below it is now byte-identical to the v1.3.0 tag.
- Move policy.s2svpnsummary out of ftds2svpn/ into its own top-level directory to match its API path (/policy/s2svpnsummaries) and how it's already wired in Policy.__init__ (never a child of FtdS2sVpn) - Drop hardcoded/unverified numbers from RateLimitError, ConcurrentRequestError, and RateLimitWriteError docstrings since the exact thresholds and scope (per-IP vs per-user) vary by FMC version and aren't confirmed by any spec in .llm/ - Remove audit_api.py and AUDIT_REPORT.md from version control; they're dev-only artifacts not used by the package. Ignore future audit artifacts in .gitignore - Restore a proper "Unreleased" CHANGELOG section for this branch's changes; the prior top section had been mislabeled "1.3.0 [2026-06-12]", but that version was already tagged and released with different content (v1.3.0 tag verified byte-identical after this fix) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
s2svpnsummary was moved to a top-level policy resource but the README tree still listed it under ftds2svpn. Verified against gen_tree.py output that the tree now matches the filesystem exactly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2 participants
Summary
fmc_oas3_7.6.5.json,fmc_oas3_7.7.12.json,fmc_oas3_10.0.1.json).templatesnamespace (device templates + 7 children), newupdatesnamespace (content/device upgrade info), newuser.externalauthsub-namespace, and ~70 new resource classes/methods acrossanalysis,device,health,integration,object,policy, andtroubleshoot.policy.healthpolicy, OSPFv2/v3 routing,policy.dnspolicy,policy.identitypolicy).SUPPORTED_FILTERSonanalysis.identifieduser, incorrectoperationIdvalues in generated docstrings (root-caused togen_docstrings.pynot loading the new spec files — now fixed), and import-ordering regressions in three namespace__init__.pyfiles.# Unreleased.Test plan
python -c "import fireREST"succeedspython -m py_compileon all changed files succeedspython -m pytest -qshows the same baseline before/after (pre-existing network-dependent test failures only, nothing newly broken)🤖 Generated with Claude Code