Configuration Search Using Prisma Cloud API

[RJesudasan]

Hi,

I'm trying to run a config search using the API. I can successfully get the JWT token and can use the token to do basic get options.

However, when trying the configuration search I get a 401 unauthorized error if I format the data as json( using header1). And if I don't specify the Content-Type, then I get a 500 internal server error ( header2). Just wondering  if someone might be able to help with identifying the issue.

Python code snippet: 

URL = 'https://api.prismacloud.io/search/config'
header1 = {"Content-Type":"application/json", "Accept": "text/csv", "x-redlock-auth":jwt}
header2 = {"Accept":"text/csv", "x-redlock-auth":jwt}

requestbody = {
        "query": "config where cloud.account = 'Name of cloud account' AND api.name = "azure-storage-account-list'",
        "timeRange": {
            "type": "relative",
            "value": {
                "unit": "hour",
                "amount": 24
            }

        }
        
    }

.....
response=request.requests('POST', URL, json=requestbody, header=header1)

[ebeuerlein · Accepted solution]

I don't see anything wrong with header1 (header 2 is missing the content-type so that would throw the 500 as expected).  If you are getting a 401, then the token has expired.  FYI, there is a syntax issue with your "query" line - you have an open single quote.

[RJesudasan]

Thanks. I don't think the token expired since I can use the same token to do other API calls such as a health check.

Thanks for pointing out open single quote. A copy paste error on my end :).

"query": "config where cloud.account = 'Name of cloud account' AND api.name = 'azure-storage-account-list'",
        "timeRange": {
            "type": "relative",
            "value": {
                "unit": "hour",
                "amount": 24
            }

        }
        
    }

[RJesudasan]

So it might be an issue with the token, since the health check doesn't need a token. Thanks for the response.