Advisor
Alright, give this a couple tests if you wouldn't mind. I standardized the property names to match my personal rules, which specify one API token per LogicModule and the api token id/key/company properties use the LogicModule name. This allows the appliesTo to simply be:
paloalto.apikey.lm.id && paloalto.apikey.lm.key && paloalto.apikey.lm.company && ssh.user && ssh.pass
You take care of making sure the paloalto.apikey.lm.* properties are on the right device and you don't have to worry about categories or anything else.
Also a tip: the password encoding can be done much more simply in powershell. It's called URI (or URL) encoding: https://stackoverflow.com/questions/23548386/how-do-i-replace-spaces-with-20-in-powershell. Looks like you just have to add System.web to make EscapeDataString work.
