iTop学习笔记--REST集成

iTop exposes a JSON REST API for reading and updating configuration items. A small Python client is enough for exploratory queries, but the endpoint and credentials should remain outside the script.

Prepare the environment

Use a documentation endpoint for local examples. Load the user and password from a protected environment file, an interactive prompt, or a secret manager.

export ITOP_URL="https://cmdb.example.test/webservices/rest.php"
export ITOP_USER="automation@example.test"
read -rsp "iTop secret (hidden input): " ITOP_PASSWORD
export ITOP_PASSWORD
printf '\n'

The three variables are required inputs. The Python program deliberately has no fallback credential.

Send a query

Install Requests in an isolated environment:

python3 -m venv .venv
. .venv/bin/activate
python -m pip install requests

Create query_itop.py:

import json
import os

import requests

itop_url = os.environ["ITOP_URL"]
username = os.environ["ITOP_USER"]
password = os.environ["ITOP_PASSWORD"]

operation = {
    "operation": "core/get",
    "class": "Person",
    "key": "SELECT Person WHERE status = 'active'",
    "output_fields": "id,friendlyname,status",
}

response = requests.post(
    itop_url,
    data={
        "version": "1.3",
        "auth_user": username,
        "auth_pwd": password,
        "json_data": json.dumps(operation),
    },
    timeout=30,
)
response.raise_for_status()
print(json.dumps(response.json(), indent=2))

Run it only after all three variables are available:

python query_itop.py

Understand the response

A successful documentation-only response may look like this:

{
  "code": 0,
  "message": "Found: 1",
  "objects": {
    "Person::100": {
      "class": "Person",
      "key": "100",
      "fields": {
        "friendlyname": "Example User",
        "status": "active"
      }
    }
  },
  "endpoint": "https://cmdb.example.test/webservices/rest.php"
}

Check both the HTTP status and the API-level code. An HTTP 200 response can still carry an application error that should stop an automation workflow.

Operational safeguards

• Grant the API account only the permissions required for the operation.
• Set a timeout and handle connection, JSON, and application errors explicitly.
• Avoid logging request bodies because authentication fields are sent with the form data.
• Prefer a trusted HTTPS certificate and keep certificate verification enabled.
• Clear the interactive secret after the session.

unset ITOP_PASSWORD

For updates, build the operation payload separately, validate it, and start with a read-only query that confirms the intended object selection.