issue with getting API connection working

[damo2929]

Hi am having issues getting netbox inventory to work and am looking for advice as am doing something wrong.

I have just built a clean container on ubuntu and deployed using 100% match
https://docs.netbox.dev/en/stable/installation/

whats needed to complete the connection and get a working inventory ?

 ansible --version
ansible [core 2.12.2]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/ansible/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.8/site-packages/ansible
  ansible collection location = /home/ansible/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.8.12 (default, May 10 2022, 23:46:40) [GCC 8.5.0 20210514 (Red Hat 8.5.0-10)]
  jinja version = 2.10.3
  libyaml = True

collections

[ansible@wlansible2 ceh-ansible]$ ansible-galaxy collection list

# /usr/share/ansible/collections/ansible_collections
Collection        Version
----------------- -------
ansible.posix     1.2.0
community.general 3.8.4
redhat.rhel_mgmt  1.0.0

# /home/ansible/.ansible/collections/ansible_collections
Collection         Version
------------------ -------
ansible.posix      1.3.0
community.general  4.8.1
community.mysql    3.2.1
community.proxysql 1.3.2
community.zabbix   1.5.1
netbox.netbox      3.9.0

inventory file

---
   plugin: netbox.netbox.nb_inventory
   api_endpoint: https://10.199.98.221/
   validate_certs: false
   config_context: false
   token: <redacted>

Heres what I get when I run it.

[ansible@wlansible2 ansible]$ ansible-inventory -i netbox-inventory.yml  --list
Permission denied: https://10.199.98.221/api/status. This may impair functionality of the inventory plugin.
Permission denied: https://10.199.98.221/api/docs/?format=openapi. This may impair functionality of the inventory plugin.
[WARNING]:  * Failed to parse /home/ansible/ceh-ansible/netbox-inventory.yml with auto plugin: 'info'
[WARNING]:  * Failed to parse /home/ansible/ceh-ansible/netbox-inventory.yml with yaml plugin: Plugin configuration YAML file, not YAML inventory
[WARNING]:  * Failed to parse /home/ansible/ceh-ansible/netbox-inventory.yml with ini plugin: Invalid host pattern '---' supplied, '---' is normally a sign this is a YAML file.
[WARNING]: Unable to parse /home/ansible/ceh-ansible/netbox-inventory.yml as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
{
    "_meta": {
        "hostvars": {}
    },
    "all": {
        "children": [
            "ungrouped"
        ]
    }
}

[rodvand]

So does your token have access to your NetBox data? The lines

Permission denied: https://10.199.98.221/api/status. This may impair functionality of the inventory plugin.
Permission denied: https://10.199.98.221/api/docs/?format=openapi. This may impair functionality of the inventory plugin

seems to suggest some permission issue.

[damo2929]

to the token is against the superuser account. other than enabling write I see no other permissions

[damo2929]

when I try accessing the url in curl I get 301's

 curl -k -v https://10.199.98.221/api/status
*   Trying 10.199.98.221...
* TCP_NODELAY set
* Connected to 10.199.98.221 (10.199.98.221) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=gb; ST=oxford; L=oxford; O=Internet Widgits Pty Ltd; CN=10.199.98.221
*  start date: Dec  1 16:03:24 2022 GMT
*  expire date: Dec  1 16:03:24 2023 GMT
*  issuer: C=gb; ST=oxford; L=oxford; O=Internet Widgits Pty Ltd; CN=10.199.98.221
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET /api/status HTTP/1.1
> Host: 10.199.98.221
> User-Agent: curl/7.61.1
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 301 Moved Permanently
< Server: nginx/1.18.0 (Ubuntu)
< Date: Fri, 02 Dec 2022 09:51:13 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 0
< Connection: keep-alive
< Location: /api/status/
< Vary: Origin
<
* Connection #0 to host 10.199.98.221 left intact

[damo2929]

yet going to the redirected url gives output

curl -k -v https://10.199.98.221/api/status/
*   Trying 10.199.98.221...
* TCP_NODELAY set
* Connected to 10.199.98.221 (10.199.98.221) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=gb; ST=oxford; L=oxford; O=Internet Widgits Pty Ltd; CN=10.199.98.221
*  start date: Dec  1 16:03:24 2022 GMT
*  expire date: Dec  1 16:03:24 2023 GMT
*  issuer: C=gb; ST=oxford; L=oxford; O=Internet Widgits Pty Ltd; CN=10.199.98.221
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET /api/status/ HTTP/1.1
> Host: 10.199.98.221
> User-Agent: curl/7.61.1
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 200 OK
< Server: nginx/1.18.0 (Ubuntu)
< Date: Fri, 02 Dec 2022 09:52:38 GMT
< Content-Type: application/json
< Content-Length: 439
< Connection: keep-alive
< Vary: Accept, Cookie, Origin
< Allow: GET, HEAD, OPTIONS
< X-Content-Type-Options: nosniff
< Referrer-Policy: same-origin
< Cross-Origin-Opener-Policy: same-origin
< X-Frame-Options: SAMEORIGIN
<
* Connection #0 to host 10.199.98.221 left intact
{"django-version":"4.0.8","installed-apps":{"debug_toolbar":"3.7.0","django_filters":"22.1","django_prometheus":"2.2.0","django_rq":"2.6.0","django_tables2":"2.4.1","drf_yasg":"1.21.4","graphene_django":"2.15.0","graphiql_debug_toolbar":"0.2.0","mptt":"0.14.0","rest_framework":"3.14.0","social_django":"5.0.0","taggit":"3.1.0","timezone_field":"5.0"},"netbox-version":"3.3.9","plugins":{},"python-version":"3.10.6","rq-workers-running":1}

[jdlayman]

Did you ever figure this out? I am seeing the same issue (including the 301 redirect to /api/status/)

[jdlayman]

Fixed my problem. I had a problem with my token. I was testing with curl without any token (which works), but an incorrect token results in a 403 response.