upstream: Operations and Local Config APIs return 404 on SCM tenant

[cdot65]

Problem

The SDK 0.13.0 Operations API and Local Config API endpoints return 404 when called against a real SCM tenant. The Incidents API works fine on the same tenant.

Failing endpoints:

• POST /operations/v1/jobs/route-table → 404
• POST /operations/v1/jobs/fib-table → 404
• POST /operations/v1/jobs/dns-proxy → 404
• POST /operations/v1/jobs/device-interfaces → 404
• POST /operations/v1/jobs/device-rules → 404
• POST /operations/v1/jobs/bgp-policy-export → 404
• POST /operations/v1/jobs/logging-service-status → 404
• GET /operations/v1/local-config/versions → 404

Working endpoints:

• POST /incidents/v1/search → 200 (returns real incidents)
• GET /incidents/v1/details/{id} → 200 (returns incident detail)
• GET /config/setup/v1/devices → 200 (returns device list)

Environment

• pan-scm-sdk 0.13.0
• API base URL: https://api.strata.paloaltonetworks.com
• Tenant has 2 PA-VM devices (austin-01, austin-02) running PAN-OS 11.2.4-h12
• Devices are connected and managed via SCM
• Valid serial numbers pass SDK validation but still get 404

Raw error

requests.exceptions.HTTPError: 404 Client Error: Not Found for url:
  https://api.strata.paloaltonetworks.com/operations/v1/jobs/route-table

ValueError: Invalid error response format

The SDK's ErrorHandler.raise_for_error fails to parse the 404 response body, raising ValueError("Invalid error response format") instead of a proper NotFoundError.

CLI behavior (v1.3.5)

The CLI catches this and shows a clear error:

Error: The Operations API returned 404 for route-table. This API may not be
available for your SCM tenant or device type. Contact Palo Alto Networks
support to verify Operations API access.

Possible causes

• Operations API requires a specific SCM license tier
• Operations API requires a different API base URL or region header
• Operations API not yet enabled for on-prem PA-VM devices
• Operations API rollout not complete for all tenants

Affected CLI commands

All scm operations and scm local commands are blocked by this:

• scm operations route-table --device <name>
• scm operations fib-table --device <name>
• scm operations dns-proxy --device <name>
• scm operations interfaces --device <name>
• scm operations device-rules --device <name>
• scm operations bgp-export --device <name>
• scm operations logging-status --device <name>
• scm operations status --job-id <id>
• scm local list --device <name>
• scm local download --device <name> --version <id>

Additional SDK bug

Incidents.get_details() has a parsing bug — the API returns {"header": {...}, "data": [<incident>]} but the SDK passes the entire response dict to IncidentDetailModel(**response) instead of extracting response["data"][0]. CLI v1.3.4+ works around this by calling the API directly.