mobile-agent API: POST/PUT/DELETE endpoints return JSON array instead of single object

[protector-nalo99]

Describe the bug

Several mobile-agent API endpoints (/config/mobile-agent/v1) return a JSON array [{...}] for POST, PUT, and DELETE operations, instead of a single JSON object {...} as declared in the OpenAPI specs (link) and in the API docs (link). This is inconsistent with both the spec and the behavior of other SCM API modules (e.g., config/objects/v1), which correctly return single objects.

Expected behavior

Per the OpenAPI spec and official documentation, POST/PUT/DELETE endpoints should return a single JSON object, matching the behavior of other SCM modules. For example, POST /config/objects/v1/addresses correctly returns:
{"id":"cac8a0e8-...","name":"my-address","folder":"Shared","fqdn":"example.com"}

Current behavior

All POST, PUT, and DELETE endpoints in the mobile-agent module wrap the response in a JSON array:
[{"name":"my-profile","folder":"Mobile Users","authentication_override":{}}]

instead of returning a single object:
{"name":"my-profile","folder":"Mobile Users","authentication_override":{}}

GET endpoints are not affected and correctly return JSON objects.

Steps to reproduce

1. Obtain a bearer token:

curl -s -X POST "https://auth.apps.paloaltonetworks.com/auth/v1/oauth2/access_token" -u "CLIENT_ID:CLIENT_SECRET" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials&scope=tsg_id:YOUR_TSG_ID"

2. Set the token as a variable (copy the access_token value from the response):

set TOKEN=eyJ0eXAiOiJKV1Qi...

3. Create a tunnel profile via mobile-agent:

curl -s -X POST "https://api.strata.paloaltonetworks.com/config/mobile-agent/v1/tunnel-profiles?folder=Mobile+Users" -H "Authorization: Bearer %TOKEN%" -H "Content-Type: application/json" -d "{"name":"test-bug-report"}"

Response:
[{"name":"test-bug-report","folder":"Mobile Users","authentication_override":{}}]

4. Create an address via objects:

curl -s -X POST "https://api.strata.paloaltonetworks.com/config/objects/v1/addresses?folder=Shared" -H "Authorization: Bearer %TOKEN%" -H "Content-Type: application/json" -d "{"name":"test-bug-report","fqdn":"example.com"}"

Response:
{"id":"abc-123","name":"test-bug-report","folder":"Shared","fqdn":"example.com"}

5. Cleanup — delete both test resources:

curl -s -X DELETE "https://api.strata.paloaltonetworks.com/config/mobile-agent/v1/tunnel-profiles?folder=Mobile+Users&name=test-bug-report" -H "Authorization: Bearer %TOKEN%"
curl -s -X DELETE "https://api.strata.paloaltonetworks.com/config/objects/v1/addresses?folder=Shared&name=test-bug-report" -H "Authorization: Bearer %TOKEN%"

Context

I am trying to add the mobile-agent endpoints to the scm-go SDK (link) by generating the client code from the OpenAPI spec using openapi-generator. However, because the API returns JSON arrays instead of single objects, the generated deserialization code fails with:
json: cannot unmarshal array into Go value of type map[string]interface{}

The operations succeed server-side (resources are created/updated/deleted), but the SDK cannot parse the response. This forces workarounds such as ignoring the response body entirely and verifying success via separate GET/List calls, which is unreliable and prevents proper error handling.

Your Environment

• Date tested: February 2026
• OS: Windows 11 entreprise 10.0.22631
• OpenAPI version: 3.0.0