Automating Asset Scanning in MaxPatrol VM via API: Part 4 on Authentication

A new technical guide from the Gazprom CPS blog details how to automate asset scanning in MaxPatrol VM through its API, beginning with the essential step of authentication.

The author notes that previous parts covered scanning of main asset types and that official documentation already addresses network equipment and virtualization. The focus now shifts to large-scale automation via API with practical Python examples.

Authorization Methods

API authorization in MaxPatrol VM supports three approaches: local account login and password, domain account login and password, and reference tokens for either local or domain accounts. The provided code examples use a local account because vendor documentation for versions newer than 2.7 was removed.

Required privileges are determined through testing. In the Management Console the minimum role is Management and Configuration: User to obtain the Bearer token. In MaxPatrol 10 a custom role must grant permissions for Assets (Vulnerabilities, Create/View/Modify/Delete, View), Extended permissions for report export, Tasks (Create/View/Modify/Delete, View), Profiles (View), and Infrastructure scope retrieval.

Obtaining the Bearer Token

All API requests require a Bearer token acquired via a POST request to the Core role endpoint. Credentials and the installation-specific ClientSecret are loaded from a non-committed .env file. The request uses grant_type password and scope mpx.api.

The response returns an access_token valid for 86400 seconds (24 hours), token_type Bearer, and the granted scopes. Once obtained, the token is placed into standard headers used for every subsequent call.

The author credits Alexey Leonov whose public GitHub script first demonstrated practical JSON export from MaxPatrol VM. Additional resources listed include a vendor webinar, SDK, CLI tool, Jira integration example, and Postman collection.