This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

User removal via API not working


I'm creating script for removal of inactive users from XG firewalls. I'm able to remove OTP tokens of the user, but can't remove user itself. It always returns error code 500 (Operation could not be performed on Entity.)

The strange thing is that it returns the same code even if I entered non-existing username instead of saying "Object doesn't exist". It looks like the request itself is wrong.

I can remove the account via GUI without any issues.

I'm using the following request:

<Request><Login><Username>admin</Username><Password>xxxxxxx</Password></Login><Remove><User transactionid=""><Username>test</Username></User></Remove></Request>

Here is the content of /log/apiparser.log

INFO Sep 06 09:24:36Z [32308]: Start Remove Handler,Component : User
ERROR Sep 06 09:24:36Z [32308]: Key:ISCrEntity is not found in RequestMap File for User.
INFO Sep 06 09:24:36Z [32308]: Mapping file for User component is /_conf/csc/IOMappingFiles//1900.1/identity/users.xml
WARNING Sep 06 09:24:36Z [32308]: Mapping element Mode is not needed now.
ERROR Sep 06 09:24:36Z [32308]: Flag setting for this opcode is 16.
INFO Sep 06 09:24:37Z [32308]: Opcode response: status:500
INFO Sep 06 09:24:37Z [32308]: End Remove Handler, Status : Success, Component : User, Transaction :

INFO Sep 06 09:24:37Z [32308]: Command:/scripts/ /sdisk/api-1662456275924800.txt /sdisk/API-1662456275924800/sdisk/APIXMLOutput/1662456275766.xml /sdisk/API-1662456275924800.tar /sdisk/API-1662456275924800.log 0 status:3
INFO Sep 06 09:24:37Z [32308]: No need to create Tar file. Response file is /sdisk/APIXMLOutput/1662456275766.xml

Has anybody here experience with user removal via API who could help me?



This thread was automatically locked due to age.
  • Hi Vishal, 

    OK. Thanks for confirmation. It must be really something specific to our environment.

    I will paste here result of the support case when it will be fixed. 

    Best regards, 


  • Hi Vishal,


    I have found the solution during preparation materials for support case. Let me summarize the real usage of User Remove API which is not described in documentation:


    1/ Tag <User> must contain parameter transactionid="" => <User transactionid="">. This I have found in another thread before I opened this thread.

    2/ Tag <Username> is ignored at all and is not needed in request even if it is mentioned in documentation as mandatory

    3/ Account username must be specified between tags <Name></Name> which is mandatory. The confusing point here is that <Name> doesn't contain the Name attribute of the user account, but Username attribute


    The reason why the tests were successful in your AD environment and for local users in my environment is that the name of the user and username were the same.

    In my AD environment the Name of the account is different than Username and that's why the request was not working for me.

    Another story is why the response is OK even if the user removal was not successful. It looks that the reponse just says that request was correct and accepted.

    The question is what is wrong? API documentation or API implementation? I will open support case to clarify it for future usage.

  • Hi Ondřej Valentík I checked internally and found that the issue is not on the documentation side but on the API side. This will be fixed in V19.0.2 MR-2 and the reference ID is NC-88291


    Vishal Ranpariya
    Technical Account Manager | Sophos Technical Support

    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link.