REST External prompt
External prompts are prompts that are sent to individuals or groups who are not using Splunk SOAR. This is also known as prompt-driven automation.
For prompts to people who use Splunk SOAR (internal prompts), see REST Approval.
REST/external_prompt
GET
Get information about an external prompt, including its message and questions.
Example request
curl -k -u username:password https://localhost/rest/external_prompt/<external prompt id> -G -X GET
Example response
A successful GET will return a JSON formatted list information about the external prompt.
{
"due_time": "2024-09-09T19:34:03.210000Z",
"status": "pending",
"action_name": "prompt_1",
"targets": [
{
"app_id": 0,
"assets": [],
"parameters": [
{
"to": null,
"ttl": 30,
"message": "msg",
"to_role": null,
"saml_group": null,
"mins_to_act": 30,
"secure_link": "https://psaas-cd-stg-marathon.soar.stg.splunkcloud.com/external-prompt/3vnHw1ZYH4G_u_f5w_caTwUPnERlH2PHaNVGDCNoMJY",
"saml_required": false,
"response_types": [
{
"prompt": "question1",
"options": {
"type": "message",
"required": true
}
}
],
"external_prompt_id": "3vnHw1ZYH4G_u_f5w_caTwUPnERlH2PHaNVGDCNoMJY"
}
]
}
]
}
POST
Post a response to an external prompt.
Syntax
curl -k -u username:password https://localhost/rest/external_prompt/<external prompt id>
Request string
An argument string must include the following fields:container_id
.
Field | Required | Type | Description |
---|---|---|---|
status | required | String | Status of the Approve, deny |
type | required | String | When completed via this API, this value is always manual .
|
action | required | String | When completed via this API, this value is always prompt .
|
responses | required | String | Answer to the questions asked. |
message | required | String | Response to the message asked. |
Example request
{"status":"approve",
"type":"manual",
"action":"prompt",
"responses":["response to question 1", "response to question 2"],
"message":"approved"}