topic Webhook Authentication in Splunk SOAR 6.4.1 in Splunk SOAR

Webhook Authentication in Splunk SOAR 6.4.1

soar_developer — Wed, 30 Jul 2025 09:07:50 GMT

Hi all,

I'm working on a Splunk SOAR connector where we plan to add support for webhooks (introduced in SOAR v6.4.1), allowing the connector to receive data from external sources. I see there's an option to enable authentication for the webhook, but after enabling it, I'm unsure what type of information needs to be included in the request.

I've tried using basic authentication and an auth token, but neither worked. Could someone please guide me on what information should be included in the request once authentication is enabled?

Re: Webhook Authentication in Splunk SOAR 6.4.1

PrewinThomas — Wed, 30 Jul 2025 09:33:49 GMT

@soar_developer

when you enable authentication, it typically expects a ph-auth-token header.

Eg: POST /rest/handler/<your_app>_<your_app_id>/... HTTP/1.1 Host: <your_soar_instance> Content-Type: application/json ph-auth-token: <your_generated_token>

Refer
#https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-cloud

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Webhook Authentication in Splunk SOAR 6.4.1

soar_developer — Wed, 30 Jul 2025 10:08:13 GMT

Hi @PrewinThomas , thanks for the reply.

I tried using the ph-auth-token, but it's not working.

It works for APIs like /rest/container/ and /rest/artifact/,
but not for the /webhook endpoint.

Ref: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-cloud#ariaid-title7