Issue/Help with "Move a security rule" - move policies across rulebase

Documentation link

API Document
https://pan.dev/access/api/prisma-access-config/post-sse-config-v-1-security-rules-id-move/

API Endpoint
https://api.sase.paloaltonetworks.com/sse/config/v1/security-rules/:id:move

Describe the problem

I am unable to move a security policy from the pre-rulebase to the post-rulebase using the Prisma Access Configuration API. This issue also occurs when moving from post-rules to pre-rules, and the same problem arises with decryption policies.
How can I request to move policies across rulebases?

In the SCM Web UI, I can move an existing security policy from the pre-rulebase to the post-rulebase using the following steps:

• Check the checkbox for the policy you want to move from the policy list
• From the Move button in the upper right, select “Move to Different Location”
• In the dialog that appears, change the Destination Rule Type radio button from Pre-Rulebase to Post-Rulebase
• Click Move

To do the same via API, I first created a security policy with the following request:

curl -s -X POST \
 -H "Content-Type: application/json" \
 -H "Authorization: Bearer ${ACCESS_TOKEN}" \
 -d '{
  "name": "test-pre-security-rule-ssl",
  "action": "allow",
  "application": ["any"],
  "category": ["any"],
  "destination": ["any"],
  "disabled": true,
  "from": ["any"],
  "service": ["any"],
  "source": ["any"],
  "source_user": ["any"],
  "to": ["any"]
}' \
"https://api.sase.paloaltonetworks.com/sse/config/v1/security-rules?position=pre&folder=Shared" | jq

The output was as follows:

{
  "id": "b61aa71c-720b-4998-939c-056ea5298342",
  "name": "test-pre-security-rule-ssl",
  "folder": "Shared",
  "policy_type": "Security",
  "action": "allow",
  "application": [
    "any"
  ],
  "category": [
    "any"
  ],
  "destination": [
    "any"
  ],
  "disabled": true,
  "from": [
    "any"
  ],
  "service": [
    "any"
  ],
  "source": [
    "any"
  ],
  "source_user": [
    "any"
  ],
  "to": [
    "any"
  ]
}

To move this rule to the post-rulebase using its UUID, I made the following request. As shown in the API documentation, I included only destination and rulebase in the request body, since those are marked as REQUIRED.

curl -s -X POST \
 -H "Content-Type: application/json" \
 -H "Authorization: Bearer ${ACCESS_TOKEN}" \
 -d '{
  "destination": "top",
  "rulebase": "post"
}' \
"https://api.sase.paloaltonetworks.com/sse/config/v1/security-rules/b61aa71c-720b-4998-939c-056ea5298342:move?folder=Shared"

The output was as follows:

{
  "_errors": [
    {
      "code": "API_I00013",
      "message": "Your configuration is not valid. Please review the error message for more details.",
      "details": {
        "errorType": "Invalid Object",
        "message": " test-pre-security-rule-ssl cannot be moved because object doesn't exist",
        "errors": [
          {
            "type": "OBJECT_NOT_PRESENT",
            "message": "Object does not exist"
          }
        ]
      }
    }
  ],
  "_request_id": "dc9e19b4-1105-481b-b7f6-4ba8103ab2ed"
}

The response message includes the rule name corresponding to the UUID, but it gives an error stating that the object does not exist.

Suggested fix

Start with the API document and the POST /sse/config/v1/security-rules/🆔move endpoint described in the issue, then reproduce the request with the supplied curl example. Compare the documented required fields with the returned OBJECT_NOT_PRESENT response for pre- and post-rulebase moves, including decryption policies; done means the supported request or the documentation clearly explains how cross-rulebase moves work.