Use XPath to Get Active Configuration

Use the

xpath

parameter to target a specific portion of the configuration. For example, to retrieve just the security rulebase:

xpath=/config/devices/entry/vsys/entry/rulebase/security

:

https://
<firewall>/api/?type=config&action=show&key=apikey&xpath=/config/devices/entry/vsys/entry/rulebase/security

There is no trailing backslash character at the end of the XPath.

Confirm that the XML response for the query looks similar to the following (truncated):

<response status="success"> 
    <result> 
        <security> 
            <rules> 
                <entry name="IT DNS Services"> 
                    <profile-setting> 
                        <group> 
                            <member>best-practice</member> 
                        </group> 
                    </profile-setting> 
                    <to> 
                        <member>untrust</member> 
                    </to> 
                    <from> 
                        <member>trust</member> 
                    </from> 
                    <source> 
                        <member>any</member> 
                    </source> 
                    <destination> 
                        <member>Data Center</member> 
                    </destination> 
                    <source-user> 
                        <member>any</member> 
                    </source-user> 
                    <category> 
                        <member>any</member> 
                    </category> 
                    <application> 
                        <member>dns</member> 
                    </application> 
                    <service> 
                        <member>application-default</member> 
                    </service> 
                    <hip-profiles> 
                        <member>any</member> 
                    </hip-profiles> 
                    <action>allow</action> 
                    <tag> 
                        <member>Best Practice</member> 
                    </tag> 
                    <log-start>no</log-start> 
                    <log-setting>default</log-setting> 
                </entry> 
... 
            </rules> 
        </security> 
    </result> 
</response>