HTTP 400 error on API call https://api2.eu.prismacloud.io/search/history/xxxxxxxx

[LChelek]

Hi,

I'm trying to inject custom policies using API call , however before doing that i need to create "Saved search" , that is later used as described in https://api.docs.prismacloud.io/reference#add-policy

So i tried simple curl-based call to create (actually update an existing saved search as advised in prisma API doc) 

curl -v --request POST --url https://api2.eu.prismacloud.io/search/history/a8a69686-65e4-46fb-a43d-b07c48163xxx

--header 'accept: application/json; charset=UTF-8'

--header 'content-type: application/json'

--header 'x-redlock-auth: my_JWT_goes_here'

--data '{"cloudType":"AWS","saved":false,"query":"config where api.name ='\''aws-ec2-describe-security-groups'\'' and cloud.account = \"Sample AWS Account\""}'

But i get :

< HTTP/2 400

<--removed-->
< x-redlock-status: [{"i18nKey":"bad_request","severity":"error","subject":null}]
< server: Jetty(9.4.24.v20191120)

In Prisma cloud web console audit logs i see:

"'xxx.xxx@xxx.com'(with role 'System Admin':'System Admin') failed to save the search."

I guess im missing some mandatory parameters in my query. Anyone got an idea whats wrong with this query? 

[LChelek]

Ok i moved one step further. Now i get HTTP 500 🙂

It looks that i was missing mandatory "name" parameter (this sounds reasonable to have config Query name as a required parameter). 

Unfortunately API docs , do not mention anything about that this field is mandatory.

So now i get HTTP 500 error (internal server error)

'x-redlock-status': '[{"i18nKey":"internal_error","severity":"error","subject":null}]'

I invoke POST against URL (where suffix of the url ismy successfuly invoked search Query id):

https://api2.eu.prismacloud.io/search/history/3ae5e3e7-532c-4c69-b858-xxxxxxxxxx

My HTTP request body  :

{"cloudType":"aws","searchType":"config","description":"","saved":true,"query":"config where api.name = 'aws-ec2-describe-subnets'","name":"MySavedQueryName-1"}

My HTTP headers:

{'accept': "application/json; charset=UTF-8",

               'x-redlock-auth': HERE_MY_JWT,

                'content-type': 'application/json',

                'User-Agent': 'Python3.7 script'

               }

What im missing here?