REST External prompt

External prompts are prompts that are sent to individuals or groups who are not using Splunk SOAR. This is also known as prompt-driven automation.

For prompts to people who use Splunk SOAR (internal prompts), see REST Approval.

REST/external_prompt

GET

Get information about an external prompt, including its message and questions.

Example request

curl -k -u username:password https://localhost/rest/external_prompt/<external prompt id> -G -X GET

Example response
A successful GET will return a JSON formatted list information about the external prompt.

{
    "due_time": "2024-09-09T19:34:03.210000Z",
    "status": "pending",
    "action_name": "prompt_1",
    "targets": [
        {
            "app_id": 0,
            "assets": [],
            "parameters": [
                {
                    "to": null,
                    "ttl": 30,
                    "message": "msg",
                    "to_role": null,
                    "saml_group": null,
                    "mins_to_act": 30,
                    "secure_link": "https://psaas-cd-stg-marathon.soar.stg.splunkcloud.com/external-prompt/3vnHw1ZYH4G_u_f5w_caTwUPnERlH2PHaNVGDCNoMJY",
                    "saml_required": false,
                    "response_types": [
                        {
                            "prompt": "question1",
                            "options": {
                                "type": "message",
                                "required": true
                            }
                        }
                    ],
                    "external_prompt_id": "3vnHw1ZYH4G_u_f5w_caTwUPnERlH2PHaNVGDCNoMJY"
                }
            ]
        }
    ]
}

POST

Post a response to an external prompt.

Syntax

curl -k -u username:password https://localhost/rest/external_prompt/<external prompt id>

Request string
An argument string must include the following fields: container_id.

Field	Required	Type	Description
status	required	String	Status of the Approve, deny
type	required	String	When completed via this API, this value is always manual.
action	required	String	When completed via this API, this value is always prompt.
responses	required	String	Answer to the questions asked.
message	required	String	Response to the message asked.

Example request

{"status":"approve",
"type":"manual",
"action":"prompt",
"responses":["response to question 1", "response to question 2"],
"message":"approved"}