topic Re: How to delete incidents with API(core-api-post /incident/batchDelete) in Cortex XSOAR Discussions

How to delete incidents with API(core-api-post /incident/batchDelete)

KeremGunal — Thu, 07 Mar 2024 11:08:44 GMT

Hello,

I am sending a command like below on the API.

!core-api-post uri="/incident/batchDelete" body="{\"filter\":{\"id\":[\"260906\"]}}"

But it does not delete the incidents I want. It does not give an error.
How to use this correctly? I want to delete all indicents before a certain date (for example 01.01.2024).

Thanks.

Re: How to delete incidents with API(core-api-post /incident/batchDelete)

RahulVijaydev — Thu, 07 Mar 2024 21:51:57 GMT

Hello,

In your payload, the incident id is passed as a filter, which is incorrect. Here is an example of the correct payload format,

!core-api-post uri=uri=`/incident/batchDelete` body=`{"ids":["260906"]}`

Additionally, the filter parameter accepts a query if you need to delete all incidents before a certain date. You can view the payload format on developer tools, by monitoring the request to delete an incident.

Please let me know if you have further questions.

Thanks,

Rahul

Re: How to delete incidents with API(core-api-post /incident/batchDelete)

KeremGunal — Thu, 07 Mar 2024 22:01:11 GMT

as an example, can you forward a query that will delete all incidents before 2024-01-01 00:00?

Re: How to delete incidents with API(core-api-post /incident/batchDelete)

KeremGunal — Thu, 07 Mar 2024 22:06:12 GMT

In addition, get error like this;

Command:

!core-api-post uri="/incident/batchDelete" body="{\"ids\":[\"306438\"]}

Reason

Error from Core REST API is : Script failed to run: Core REST APIs - Request Failed. Status code: 400. Body: {"StatusCode":400,"Status":"400 Bad Request","Cookies":[],"Body":"{\"id\":\"missing_request\",\"status\":400,\"title\":\"Bad request\",\"detail\":\"Request body is missing mandatory parts.\",\"error\":\"Missing required filter argument on batch request (7)\",\"encrypted\":false,\"multires\":null}\n","Bytes":