The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter provides examples and describes how to use the following individual Change of Authorization (CoA) REST API calls that are supported in this release of Cisco Identity Services Engine. The CoA API calls provide the means for sending session authentication and session disconnect commands to a specified Cisco Monitoring ISE node in your Cisco ISE deployment.
The following sections provide API output schema file examples, procedures for issuing each API call, and a sample of the data returned by each API call:
The CoA session management API calls allow you to send reauthentication and disconnect commands to a specified session on a target Cisco Monitoring ISE node in your Cisco ISE deployment:
This section provides a schema file output example, a procedure for sending a session reauthentication command and Reauth type by invoking the Reauth API call, and a sample of the data returned after this API call is issued. The reauth types can be any of the following:
This sample schema file is the output of the Reauth API call after sending it to a specified session on the target Cisco Monitoring ISE node:
Note Make sure that you have verified that the target node to which you are issuing an API call is a valid Cisco Monitoring ISE node. To verify the persona of a Cisco ISE node, see Verifying a Cisco Monitoring ISE Node.
To issue the Reauth API call, complete the following steps:
Step 1 Log into the target Cisco Monitoring ISE node.
For example, when you initially log into a Cisco Monitoring ISE node with the hostname of acme123, this would display the following URL Address field for this node:
Step 2 Enter the Reauth API call in the URL Address field of the target node by replacing the “/admin/” component with the API call component (/ise/mnt/api/CoA/<specific-api-call>/<macaddress>/
<reauthtype>/<nasipaddress>/<destinationipaddress>):
Note You must carefully enter each API call in the URL Address field of a target node because these calls are case-sensitive. The use of “mnt” in the API call convention represents a Cisco Monitoring ISE node.
Step 3 Press Enter to issue the API call.
The following example illustrates the data returned when you invoke a Reauth API call on a target Cisco Monitoring ISE node. Two possible results can be returned from invoking this command:
This section provides a schema file output example, a procedure for sending a session disconnect command and a port option type by invoking the Disconnect API, and a sample of the data returned after this API call is issued. The disconnect port option types can be any of the following:
This sample schema file is the output of the Disconnect API call after sending it to a specified session on the target Cisco Monitoring ISE node:
Note Make sure that you have verified that the target node to which you are issuing an API call is a valid Cisco Monitoring ISE node. To verify the persona of a Cisco ISE node, see Verifying a Cisco Monitoring ISE Node.
To issue the Disconnect API call, complete the following steps:
Step 1 Log into the target Cisco Monitoring ISE node.
For example, when you initially log into a Cisco Monitoring ISE node with the hostname of acme123, this would display the following URL Address field for this node:
Step 2 Enter the Disconnect API call in the URL Address field of the target node by replacing the “/admin/” component with the API call component (/ise/mnt/api/CoA/<Disconnect>/<serverhostname>/
<macaddress>/<portoptiontype>/<nasipaddress>/<destinationipaddress>):
Note You must carefully enter each API call in the URL Address field of a target node because these calls are case-sensitive. The use of “mnt” in the API call convention represents a Cisco Monitoring ISE node.
Step 3 Press Enter to issue the API call.
The following example illustrates the data returned when you invoke a Disconnect API call on a target Cisco Monitoring ISE node. Two possible results can be returned from invoking this command: