topic Re: API delete endpoint from Identity Group without deleting endpoint itself in Network Access Control

API delete endpoint from Identity Group without deleting endpoint itself

SamuelFullman6827 — Tue, 30 Jul 2019 17:29:00 GMT

I've successfully implemented a `delete` method already for endpoints via their unique id.

What I want to do is remove a specific MAC address from an identity group, without deleting the MAC itself from ISE. How do I do this?

Re: API delete endpoint from Identity Group without deleting endpoint itself

Mike.Cifelli — Tue, 30 Jul 2019 17:59:06 GMT

You should be able to accomplish this via a PUT call. Are you trying to move the endpoint from identity group to another? Or simply not have it assigned to a group at all and still keep in ISE db?

Re: API delete endpoint from Identity Group without deleting endpoint itself

Johannes Luther — Wed, 31 Jul 2019 05:39:53 GMT

It's the "Update" operation of the endpoint API (like Mike said it's an HTTP PUT).

Do you know, that the API documentation in the ISE live system is pretty good for this?

https://{FQDN-YOUR-ISE}:9060/ers/sdk

For your specific question:

API URL: https://{FQDN-YOUR-ISE}:9060/ers/config/endpoint/{id}

Method: PUT

Content (json):

{
  "ERSEndPoint" : {
    "groupId" : "groupId"
  }
}

Re: API delete endpoint from Identity Group without deleting endpoint itself

SamuelFullman6827 — Wed, 31 Jul 2019 17:23:16 GMT

OK, but how is a `PUT` with a reference to the identity groupId I _DON'T_ want the endpoint to be in serve to remove the endpoint from that identity group?

Re: API delete endpoint from Identity Group without deleting endpoint itself

SamuelFullman6827 — Wed, 31 Jul 2019 17:27:44 GMT

I am wanting to unassign it to THAT group, without regard to changing any other group. Which means, if it's not in any other group then yes it's just in the ISE db as you said. How is a `PUT` with a reference to the identity groupId I _DON'T_ want the endpoint to be in serve to remove the endpoint from that identity group?

Re: API delete endpoint from Identity Group without deleting endpoint itself

Mike.Cifelli — Wed, 31 Jul 2019 18:34:05 GMT

I recommend trying something along these lines:
API_OLD_DEVICE2 = "https://ABCDEFGH:9060/ers/config/endpoint/"+ temp (or your endpoint ID string; all depends on your code)
API_ERS_USER = "ERS_USER","PASSWORD"
API_DATA = {
"ERSEndPoint" : {
"staticGroupAssignment" : "true",
"description" : "test",
"groupId" : "",
}
}

r = requests.put(url=API_OLD_DEVICE2, auth=API_ERS_USER, verify=True, json=API_DATA)
print "**********************"
print "ISE Request", r.reason
print "**********************"
See what happens when leaving groupID with "" instead of specifying a specific group.

Re: API delete endpoint from Identity Group without deleting endpoint

eneskayahan — Fri, 16 Dec 2022 12:07:16 GMT

Note: To remove an endpoint from an ID group, simply change staticGroupAssignment to false.

I tried this and it worked

Source:

https://community.cisco.com/t5/security-knowledge-base/ise-ers-api-examples/ta-p/3622623#toc-hId--843015986