IBM Support

QRadar: Deleting an Application from the API



The procedure in this document outlines how administrators can verify the application ID to delete the application (app) from the QRadar API, then reinstall the application in QRadar. These steps are useful when applications cannot be installed or are installed in an error state.

Resolving The Problem

  1. Login to https:///api_doc
  2. Use the latest API version, find /gui_app_framework.
  3. Click /applications:
  4. Scroll to bottom, click Try It Out! and get the application_id:
    Optionally, you can use the command line and the recon utility to retrieve the application_id.
  5. Click /{application_id} that is located under /applications:
  6. Use the DELETE endpoint to delete the app, enter the application_id you retrieved in step 4 and click on try it now.
  7. Go to Admin > Extensions Management on your QRadar UI and delete the APP if it is still there.
  8. Using SSH, login to your QRadar Console and verify the the /store/qapp directory exists.
  9. If the directory does not exist, create the directory by running the following commands:
  10. To create the directory, type: mkdir /store/qapp
  11. To set the proper permissions on the directory, type: chown nobody:nobody /store/qapp/
  12. Reinstall the latest version of the application using the Admin tab > Extension Management.
  13. Clear your browser cache and cookies.
  14. Attempt to open the application.

    WARNING: Deploy Full Configuration which restart services on all hosts in the QRadar deployment and cause an outage in event and flow collections processed until services restart. Active scheduled searches and reports are canceled till their next run cycle. Administrators should consider completing the next step during a scheduled maintenance window.
  15. If the application does not start, administrators can restart services Admin tab > Advanced > Deploy Full Configuration.

    If the issue wasn't resolved by restarting services, administrators can open a support ticket with IBM QRadar Support. IBM QRadar Support troubleshoots and resolves issues related to the QRadar application framework and issues related to IBM developed applications. For non-IBM applications, see the X-Force App Exchange website to identify the support representative for your specific application. Administrators can also ask questions using the QRadar Customer forums at:


Document Location


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar->Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.2;7.3.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
21 April 2020