upstream: SCM API server-side failures discovered during E2E testing

[cdot65]

Overview

During E2E testing (#134-#139), several CLI commands fail due to SCM API server-side errors — the CLI correctly sends the request but the API returns 400/500 errors. These are not CLI bugs and cannot be fixed in this project. They are documented here for tracking and to inform users.

---

Failure 1: Network Location — API 500

Issue: scm show sase network-location returns persistent 500 errors.

Command:

scm show sase network-location

Error:

too many 500 error responses on /config/deployment/v1/locations

Analysis: The SCM API endpoint /config/deployment/v1/locations is returning HTTP 500 (Internal Server Error). The CLI correctly calls the endpoint; the failure is server-side.

CLI code path: src/scm_cli/utils/sdk_client.py → list_network_locations() → self.client.network_location.list()

Remediation: None possible in CLI. Monitor if the API endpoint stabilizes. Consider adding a user-friendly message when 500 errors are detected on this endpoint.

---

Failure 2: Remote Network — API 500

Issue: scm show sase remote-network and scm backup sase remote-network return persistent 500 errors.

Commands:

scm show sase remote-network
scm backup sase remote-network

Error:

too many 500 error responses on /sse/config/v1/remote-networks

Analysis: The SCM API endpoint /sse/config/v1/remote-networks is returning HTTP 500. This affects both list and backup operations.

CLI code path: src/scm_cli/utils/sdk_client.py → list_remote_networks() → self.client.remote_network.list()

Remediation: None possible in CLI. Same as above.

---

Failure 3: Route Access List — API 500

Issue: scm show network route-access-list --folder Texas and backup both return persistent 500 errors.

Commands:

scm show network route-access-list --folder Texas
scm backup network route-access-list --folder Texas

Error:

too many 500 error responses

Analysis: The SCM API endpoint for route access lists returns HTTP 500. Server-side issue.

CLI code path: src/scm_cli/utils/sdk_client.py → list_route_access_lists() → self.client.route_access_list.list(folder=folder)

Remediation: None possible in CLI.

---

Failure 4: Route Prefix List — API 500

Issue: scm show network route-prefix-list --folder Texas and backup both return persistent 500 errors.

Commands:

scm show network route-prefix-list --folder Texas
scm backup network route-prefix-list --folder Texas

Error:

too many 500 error responses

Analysis: Same pattern as Route Access List. Server-side 500 errors.

CLI code path: src/scm_cli/utils/sdk_client.py → list_route_prefix_lists() → self.client.route_prefix_list.list(folder=folder)

Remediation: None possible in CLI.

---

Failure 5: QoS Profile — API rejects folder "Texas"

Issue: scm show network qos-profile --folder Texas is rejected by the API because QoS Profiles only support specific folders.

Commands:

scm show network qos-profile --folder Texas
scm backup network qos-profile --folder Texas

Error:

API_I00035: "folder" must be one of [Remote Networks, Service Connections]

Analysis: The SCM API enforces that QoS Profiles can only exist in "Remote Networks" or "Service Connections" folders. The CLI allows any folder to be passed.

CLI code path: src/scm_cli/commands/network.py → show handler → scm_client.list_qos_profiles(folder=folder)

Remediation (CLI-side, optional): Could add validation in the CLI to warn users that QoS Profiles only support "Remote Networks" or "Service Connections" folders. Alternatively, update the documentation to note this restriction. The commands work correctly with the right folders:

scm show network qos-profile --folder "Remote Networks"
scm show network qos-profile --folder "Service Connections"

---

Failure 6: Quarantined Device — API 400

Issue: scm show object quarantined-device returns HTTP 400.

Command:

scm show object quarantined-device

Error:

HTTP 400: Could not initiate the job for device quarantine

Analysis: The quarantined device API endpoint returns a 400 error. This may be a permissions issue or the endpoint may require specific tenant configuration. Note that we already fixed the CLI to use the correct singular SDK service name (quarantined_device) in PR #149.

CLI code path: src/scm_cli/utils/sdk_client.py → list_quarantined_devices() → self.client.quarantined_device.list()

Remediation: None possible in CLI. May require specific tenant permissions or configuration.

---

Summary Table

#	Resource	Error	Endpoint	Actionable in CLI?
1	Network Location	500	/config/deployment/v1/locations	No
2	Remote Network	500	/sse/config/v1/remote-networks	No
3	Route Access List	500	route-access-list endpoint	No
4	Route Prefix List	500	route-prefix-list endpoint	No
5	QoS Profile	400 (folder restriction)	qos-profile endpoint	Optional: validate folder
6	Quarantined Device	400	quarantined-device endpoint	No

Action Items

• Monitor API endpoints periodically to check if 500 errors resolve
• Consider adding QoS Profile folder validation in CLI (optional enhancement)
• Document QoS Profile folder restriction in docs
• Report persistent 500s to Palo Alto Networks support if they continue