Custom API Action

Make an authenticated HTTP request to the Splunk Enterprise Security API.

See Splunk Enterprise Security REST API Guide.

Options

Field Definition Type Required

Request Type

These are the supported HTTP request methods, or HTTP verbs, in a custom API call (see HTTP request methods).

  • GET: Retrieves data from a web server based on parameters. This method requests a representation of the specified resource. If a request is successful, a 200 (OK) response message is returned with the requested content.

  • POST: Sends data to a web server based on parameters, for example, uploading a file. Multiple POST requests may result in a different outcome than a single POST. Exercise caution to avoid sending multiple POST requests unintentionally. If a request is successful, a 200 (OK) response message is returned.

  • PUT: Sends data to be stored at a specific location on a web server based on parameters, such as uploading a file. Unlike POST requests, PUT requests are idempotent. For successful requests, the result of a single PUT request is the same as many identical PUT requests. If a request is successful, a 200 (OK), 201 (Created), or 204 (No Content) response message is returned.

  • PATCH: Applies partial modifications to a resource on a web server based on parameters. PATCH isn't idempotent. Multiple PATCH requests could have unintended consequences. If a PATCH is successful, a 200 (OK) or 204 (No Content) response message is returned.

  • DELETE: Deletes the specified resource if it exists from the web server based on parameters. If a DELETE is successful, a 200 (OK) response message is returned.

Dropdown TRUE

Input

Field Definition Type Required

Request

Relative URL

The URL address of the web server that you're attempting to call. Specify the relative URL as /{insert_remaining_URL}. You can specify query parameters in the relative URL using "?", or specify the query parameters as an object key pair in the Query input.

Text TRUE

Headers

Specify any headers required in addition to authorization or content-type (these are already handled by this connector).

 Object FALSE

Query

Specify any additional query parameters that should be included in object format (key value pairs).

 Object FALSE

Body

Specify a request body in JSON format. Only available for POST, PUT, and PATCH requests.

Object FALSE

Output

Field Definition Type

Response

Status Code

Result of the operation. The connector returns an HTTP status code that indicates whether the action taken by the card succeeded or failed. For example:

  • A 201 Created status code indicates success where a new resource was created.
  • A 403 Forbidden error indicates that the HTTP request wasn't processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

 Number

Headers

Detailed context for the status code, unrelated to the output body. Response headers depend on your selected HTTP request option. Not all headers are response headers. This is similar to {"Content-type":"application/json"}.

 Object

Body

Data returned from your selected HTTP request.

For example, the data from a GET request.

 Object