FalconPy - Error 403 for PerformActionV2 API Endpoint

[usmanzargar]

Hi Guys,

I have a requirement where I need to delete entries for ephemeral machines in Falcon console. I am utilizing FalconPy for this. I am getting a list of host ID's that I need to delete with the help of "QueryDevicesByFilterScroll" endpoint and once I retrieve those out, I am trying to feed them to the PerformAction endpoint. However I am getting a 403 error with the message - 'access denied, authorization failed'. This is very strange as the API creds I am using has the Host "Read" scope and that's what the documentation states. I wasn't able to find anything online for this. Below is my script,

From falconpy import APIHarnessV2
import pandas as pd

falcon = APIHarnessV2(client_id='client_id',
                      client_secret='client_secret')


get_host_id = falcon.command("QueryDevicesByFilterScroll",
                          offset='',
                          limit=5000,
                          sort='',
                          filter="hostname:'name of the host'"
                          )

id_list = get_host_id["body"]["resources"]

#print(id_list)

params = {
    "action_name": "hide_host"
}

body = {
    "ids": f"{id_list}"
}

delete_falcon_host = falcon.command("PerformActionV2", parameters=params, body=body)
print(delete_falcon_host)

Can anyone help me here?

[crowdstrikedcs]

Hi @usmanzargar thanks for the question! A 403 response back indicates either a scoping issue (where the client/secret pair is not authorized for the given action) or an IP Blocklist is being enforced.

Based on your success in using the QueryDevicesByFilterScroll operation it appears the first case is occurring. The PerformActionV2 operation should require the Write permission be added for the same Hosts scope you have Read permission for already. Can you try adding this?

[usmanzargar]

Thanks a ton @crowdstrikedcs !! This has solved the problem. Very strange why the API doc (in the console) states that we only need a Host: 'Read' scope for deleting a host.

However, I am getting another error now - 400 : "Provided data does not match expected 'Action Parameter' format". I am using the uber class example from the FalconPy Docs. Let me see if I am able to find anything online and solve this. I will reply here if I get stuck again...

Thank you once again!

[usmanzargar]

Okay, I solved it... Instead of passing a formatted string in the body of the request, I directly assigned the list to it. Something like below,

body = {
"ids": id_list
}

Thanks @crowdstrikedcs once again!