Splunk® SOAR (Cloud)

REST API Reference for Splunk SOAR (Cloud)

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

Delete Records

Records can be deleted by an authorized user. This can be done by issuing an HTTP DELETE to /rest/<type>/<id>. Deletion can only be done by a user account with the correct privileges and not by a connection authenticated using a REST token. The Python requests module implements both HTTP Basic user auth as well as HTTP DELETE.

/rest/<type>/<id>

Syntax

https://<username>:<password>@<host>/rest/<type>/<id>

DELETE

Delete a record.

Example Python request
Delete container Id 42.

requests.delete('https://192.168.1.1/rest/container/42', auth=('admin', 'password'))

Example response
A successful DELETE will return a success message.

{
    "success": true
}

Example curl request
Delete the custom CEF Id 151.

curl -k -u admin:changeme https://localhost/rest/cef/151 -X DELETE

Example response
A successful DELETE will return the success message.

{
    "success": true
}

Failures will return a non-200 response code and JSON with "failed" = true and an appropriate "message".

Delete is only supported for the following record types:

  • Apps (/rest//rest/app/<id>)
  • Artifacts (/rest/artifact/<id>)
  • Assets (/rest/asset/<id>)
  • CEF (/rest/cef/<id>)
  • Containers (/rest/container/<id>)
  • Container Attachments (vault files such as /rest/container_attachment/<id>)
  • Custom Lists (/rest/decided_list/<id>)
  • Roles (/rest/role/<id>)
  • Workbooks (/rest/workbook_template/<id>)

Custom Lists can be deleted with user or token authentication. All others require user authentication.

Last modified on 06 November, 2024
Bulk Create and Update Records   Get System Info

This documentation applies to the following versions of Splunk® SOAR (Cloud): current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters