QRadar: Cannot install application by using the QRadar Hub app due to an issue with API credentials

Troubleshooting

Problem

Administrators who try to upgrade or install an application by using the QRadar Hub app can receive the error "Retry Update".

Symptom

The following image illustrates the Deployment Intelligence app not being upgraded and requesting to "Retry Update": image-20250617155135-1

Diagnosing The Problem

Administrators run the following steps to confirm the issue:

Depending on where the apps are running, use SSH to log in to the QRadar Console as the root user OR the QRadar Apphost.

Run the recon script to find the QRadar Hub app-id:

/opt/qradar/support/recon ps

Output example:
Note: In this output, the app-id for QRadar Hub is 1102.

App-ID  Name                            Managed Host ID Workload ID             Service Name    AB      Container Name  CDEGH   Port   IJKL
1108    User Analytics                  53              apps                    qapp-1108       +-      qapp-1108       +-+--   5000   ----
1251    IBM QRadar SOAR Plugin          53              apps                    qapp-1251       ++      qapp-1251       +++++   5000   ++++
1110    Deployment Intelligence         53              apps                    qapp-1110       ++      qapp-1110       +++++   5000   ++++
1252    Reference Data Management       53              apps                    qapp-1252       ++      qapp-1252       +++++   5000   ++++
1103    QRadar Use Case Manager         53              apps                    qapp-1103       ++      qapp-1103       +++++   5000   ++++
1101    Pulse - Dashboard               53              apps                    qapp-1101       ++      qapp-1101       +++++   5000   ++++
1104    QRadar GraphQL                  53              apps                    qapp-1104       ++      qapp-1104       +++++   5000   ++++
1051    QRadar Log Source Management    53              apps                    qapp-1051       ++      qapp-1051       +++++   5000   ++++
1102    IBM QRadar Hub                  53              apps                    qapp-1102       ++      qapp-1102       +++++   5000   ++++
1105    QRadar Analyst Workflow         53              apps                    qapp-1105       ++      qapp-1105       +++++   5000   ++++

Move to the QRadar Hub application logs by using the cd command:
Note: Replace <id> with the app-id from step 2.
```
cd /store/docker/volumes/qapp-<id>/log
```
Example:
```
cd /store/docker/volumes/qapp-1102/log
```

Use the grep command to filter the logs:

grep -E 'XFE Creds' app.log

Output example:
Note: The following log is the indicator of the error.

[MainThread] [ERROR] [APP_ID:1102] [NOT:0000003000] download.py: accept_zip_license(): xfe_id: xxxxxxxxxxxxxxxxxxxxxx: Error: Failed to accept license - download.py: accept_zip_license(): Could not accept extension license before downloading. Possible issue with XFE Creds.

Result
Administrator confirmed the error and can continue with the Resolving The Problem section.

Resolving The Problem

Administrators must create new API credentials in IBM X-Force Exchange and update the API credentials in the QRadar Hub app.

Steps :

Create new API credentials

Administrator needs to generate new API credentials for the QRadar Hub app by running the following steps:

Log in to the IBM X-Force Exchange.
Go to your profile and click Settings.
Click API Access and then click the Generate button:
Copy the API Key and Password and click API Documentation to validate the API credentials:
In the IBM X-Force Exchange API, paste the API credentials and click the Authenticate button:

Result
Administrator has new API credentials and can continue with the Update the API credentials section.

Update the API credentials in QRadar Hub

Administrator needs to apply the new API credentials in the QRadar Hub app by running the following steps:

Log in to the QRadar Console as an administrator.
Click the QRadar Hub app icon:
Click the settings icon in the QRadar Hub app:
Add the new API credentials in the API Authentications tab:
Verify the credentials and click the Save button:

Result

Administrator applied the API credentials for QRadar Hub app and can now update or install applications. If the administrator continues to experience issues, contact QRadar Support for assistance.

Related Information

IBM QRadar Hub app

QRadar Deployment Intelligence app

IBM X-Force Exchange API

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Tips