I need help from anyone with experience using the ArcSight esm rest API

Question

I was able to get the auth token from the login api but I am trying to use it to query the events api and I am getting a 401 Client Error: Unauthorized for url error message. Here is a snippet of my code:

def action():
    data = {
        'login': 'xxxxxxxxx',
        'password': 'xxxxx',
    }

    urllib3.disable_warnings()
    try:
        timestamp = int(round(time.time() * 1000))
        print(timestamp)
        r = requests.post(
            'https://host:port/www/core-service/rest/LoginService/login', data=data, verify=False)
        login_request = untangle.parse(r.text)
        user_session_id = login_request.ns3_loginResponse.ns3_return.cdata
        print(user_session_id)

        response = requests.post(
            'https://host:port/detect-api/rest/v1/events/retrieve',
            headers={
                "Accept": "application/json",
                "Authorization": user_session_id,
                "Content-Type": "application/json"
            },
            data={
                "ids": 79745681,
                "startTime": timestamp,
                "endTime": timestamp
            },
            verify=False)
        print(response)
        res = untangle.parse(response.text)
        print(res)

Can somebody please point out what is wrong with my code?

where is documentation for API? It seems you use it in wrong way. — furas, Jul 12 '21 at 12:15
if you set `"Content-Type": "application/json"` then it can means you want to send `json` data - so you should use `get(..., json=...)` instead of `get(..., data=...)` — furas, Jul 12 '21 at 12:17
@furas this api request worked when I curled it on my terminal but it isn't working in my script — Jakpor Nobert, Jul 12 '21 at 12:20
if `curl` works then you should say it in question and you show this `curl` in question (not in comment). There are tools which can convert `curl` to `Python` - ie. https://curl.trillworks.com/ . And when you use `POSTMAN` for tests then it has also functions to generate code for `curl`, `Python` and many other languages. — furas, Jul 12 '21 at 12:22
@furas I just converted the curl request to python and the output was accurate with what I did on my python script. So I have no idea what the problem is — Jakpor Nobert, Jul 12 '21 at 12:50
these tools sometimes doesn't create correct result. And sometimes only human can convert it correctly. But you still didn't add curl to question - so you only waste time. We can't read in your mind - you have to add ALL information in question. — furas, Jul 12 '21 at 13:31

furas · Answer 1 · 2021-07-12T12:31:45.530

You didn't add link to API so I only guess what can make problem.

If you set "Content-Type": "application/json" then it can means you want to send json data.

So you should use

post(..., json=...)

instead of

post(..., data=...).

Using data= you send it as form, not json. And header Content-Type can't change it.

And when you use json= then you don't have to add "Content-Type": "application/json" because requests will add it automatically.

EDIT:

In comment you said that you have working curl command (but you didn't said it in question, and you didn't show curl in question)

On page https://curl.trillworks.com you can convert curl to Python (and few other languages) and mostly it works correctly.

BTW:

If you use postman for tests then it has also function to generate code for curl, Python and many other languages.

You didn't show link to API documentation but often API documentation has examples for curl and sometimes even for Python.

I need help from anyone with experience using the ArcSight esm rest API

1 Answers1