ISE Guest user suspend API (ERS) with 401 – Unauthorized

[Paul_02]

Hi all,

I'm facing the similar issue like this ticket . My Cisco ISE version is 3.1 with the latest patch 10 (3.1.0.518). I'm sure that the account has the right privileges (ERS operation, ERS Admin, System Admin). I can list guest users with REST APIs, but cannot suspend/reinstate with 401 error. I can do write operations (create, suspend, reinstate, etc.) from sponsor portal. Could anyone help to check it? Here is the example to suspend a guest user with Postman.

Thanks,
Paul

[Greg Gibbs]

You need to use a Sponsor account with the relevant permissions for calls against the Guest API. The RBAC roles for 'ERS Admin' are not relevent for this API.

https://developer.cisco.com/docs/identity-services-engine/latest/setting-up/#setting-up-ers-for-sponsor-access

[Paul_02]

Hi Greg, 

Thank you for your reply!

Actually I have the Sponsor account (which is an Admin account as well). As I mentioned above, I can list guest users with this account by calling API `/ers/config/guestuser`, but I cannot create/suspend/reinstate guest users.