topic Use Cisco FMC API to create user in Network Security

Use Cisco FMC API to create user

Difan_Zhao — Mon, 17 Mar 2025 22:00:33 GMT

Hi team,

I am trying to create a user with the API. I can't find the scheme for the payload data with the api-explorer. I have tried different payload data like the following one without success... I am using Postman. The URL I used is {{url}}/api/fmc_config/v1/domain/{{domainUUID}}/users/users. I can pull users.

{ "type": "User", "username": "testuser", "roles": [ { "name": "Administrator", "id": "xxxx-xxx-xx-xxx-xxxxxx", "type": "AuthRole", } ], "email": "xxx@xxx.com", "enabled": true }

I am getting this error:

{ "error": { "category": "OTHER", "messages": [ { "description": "Wildcard string cannot be null or empty. Make sure permission strings are properly formatted." } ], "severity": "ERROR" } }

Would appreciate it if you could point out where I did wrong. Thanks!

Re: Use Cisco FMC API to create user

Marius Gunnerud — Tue, 18 Mar 2025 13:28:50 GMT

What version FMC are you running?

From what I can see in FMC 7.4.2.2 there is no option to create a user using API, you are only able to "GET" information about users.

Re: Use Cisco FMC API to create user

Difan_Zhao — Tue, 18 Mar 2025 14:39:27 GMT

Hi Marius, I am on Version 7.4.2.1 (build 30). I didn't see it in the API explorer too and I was hoping that it is merely just missed... Could you confirm that this is not a supported feature? Besides API, is there another way to do bulk user creation? Thanks!

Re: Use Cisco FMC API to create user

Marius Gunnerud — Tue, 18 Mar 2025 15:18:46 GMT

As of FMC version 7.7 there is no option to add users via API. So the only way to add local users is through the GUI. Optionally integrate the FMC with a remote authentication server...i.e. AD.

Re: Use Cisco FMC API to create user

Difan_Zhao — Tue, 18 Mar 2025 16:40:27 GMT

Hi Marius, I am actually trying to create remote users and not local ones. We use the Cisco ISE as the remote authentication server and we use Radius as the protocol because it is the only one supported. However, as far as I know, you still need to create individual users, check box "Use External Authentication Method", and assigna roles... I have attached a screenshot for what we usually do with the GUI. Is there a better way to do that? Thanks!