IBM Support

QRadar: The API returns an Error "code" :404,"message": "We could not find the resource you requested."

Troubleshooting


Problem

When trying to pull information from a reference table by using the API, an error is displayed:
{"http_response":{"code":404,"message":
"We could not find the resource you requeference_data\/tables\/My%20Table\/)
is not a known endpoint resource. Please refer to documentation for list of endpoint resources."}

Resolving The Problem

The rest API call (the one that contains the URL) does not end with "/". If you use an "/" the system expects more information after the slash. The table from the error message was created by using the Reference Data Management app. If a table is not created, you receive [ ] as a response from the REST API call. You can test the response by using the API test tool.

To test the cURL responses:
  1. Log in to the QRadar Console.
  2. Click the navigation menu (☰) > Interactive API for Developers.
  3. Click reference_data > Tables.
  4. Add the curl string to the cURL text boximage 7698
    1. With a slash "/", you get the "404" error: 
      curl -S -X GET -u admin -H 'Range: items=0-49' -H 'Version: 13.0' -H 'Accept: application/json' 'https://10.10.10.1/api/reference_data/tables/My%20Table/'
      Enter host password for user 'admin':
{"http_response":{"code":404,"message":"We could not find the resource you requested."},"code":4,"description":"","details":{},"message":"Relative path (\/reference_data\/tables\/My Table\/) is not a known endpoint resource. Please refer to documentation for list of endpoint resources."}
    2. To pull all tables information use the call: 
      curl -s -X GET -u admin -H 'Range: items=0-49' -H 'Version: 13.0' -H 'Accept: application/json' 'https://x.x.x.x/api/reference_data/tables'
      Replace "x.x.x.x" with your Console IP address. 
      Enter host password for user 'admin':
[{"timeout_type":"FIRST_SEEN","number_of_elements":1,"creation_time":16092628931
14,"name":"Tableone","key_name_types":{"Inner Key 1":"ALN"},"element_type":"ALN"
    3. To pull information for a specific table you need to add the /name to the endpoint: 
      curl -S -X GET -u admin -H 'Range: items=0-49' -H 'Version: 13.0' -H 'Accept: application/json' 'https://10.10.10.1/api/reference_data/tables/My%20Table'
      In the example, replace the IP address is x.x.x.x with the one from the Console, the value "My Table" is the table name, and "%20" means space.

      Results
      Though the article was created for the reference table, the slash at the end applies to other API calls too.

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"TS004020452","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Document Information

Modified date:
05 January 2021

UID

ibm16257619

Page Feedback