You can use
curl to directly interact with PuppetDB’s REST API. This is useful for testing, prototyping, and quickly fetching arbitrary data.
The instructions below are simplified. For full usage details, see the curl manpage . For additional examples, please see the docs for the individual REST endpoints:
With its default settings, PuppetDB accepts unsecured HTTP connections at port 8080 on
localhost. This allows you to SSH into the PuppetDB server and run curl commands without specifying certificate information:
curl 'http://localhost:8080/v3/facts/<node>' curl 'http://localhost:8080/v3/metrics/mbean/java.lang:type=Memory'
If you have allowed unsecured access to other hosts in order to monitor the dashboard, these hosts can also use plain HTTP curl commands.
curl From Remote Hosts (SSL/HTTPS)
To make secured requests from other hosts, you will need to supply the following via the command line:
- Your site’s CA certificate (
- An SSL certificate signed by your site’s Puppet CA (
- The private key for that certificate (
Any node managed by puppet agent will already have all of these and you can re-use them for contacting PuppetDB. You can also generate a new cert on the CA puppet master with the
puppet cert generate command.
Note: If you have turned on certificate whitelisting, you must make sure to authorize the certificate you are using:
curl 'https://<your.puppetdb.server>:8081/v3/facts/<node>' --cacert /etc/puppet/ssl/certs/ca.pem --cert /etc/puppet/ssl/certs/<node>.pem --key /etc/puppet/ssl/private_keys/<node>.pem --tlsv1
For Puppet Enterprise, the paths to the SSL certificates are different, so use the following example instead:
curl 'https://<your.puppetdb.server>:8081/v3/facts/<node>' --cacert /etc/puppetlabs/puppet/ssl/certs/ca.pem --cert /etc/puppetlabs/puppet/ssl/certs/<node>.pem --key /etc/puppetlabs/puppet/ssl/private_keys/<node>.pem --tlsv1
Locating Puppet Certificate Files
ssldir as follows:
$ sudo puppet config print ssldir
Within this directory:
- The CA certificate is found at
- The corresponding private key is found at
- Other certificates are found at
Dealing with complex query strings
Many query strings will contain characters like
], which must be URL-encoded. To handle this, you can use
If you do this with an endpoint that accepts
GET requests, you must also use the
--get option. This is because
curl defaults to
POST requests when the
--data-urlencode option is present.
curl -G 'http://localhost:8080/v3/nodes' --data-urlencode 'query=["=", ["node", "active"], true]'