REST API Input in Add-on Builder: POST body not affecting response

[rayleigh29]

I'm using Splunk Add-on Builder to configure a REST API input for Samsung Knox.

REST URL: https://region.manage.samsungknox.com/emm/oapi/audit/read

POST Request Headers:

• Authorization: Bearer <token>

• Content-Type: application/x-www-form-urlencoded

POST Request Body

• client_id
• client_secret
• grant_type
• timeZone = +07:00
• includeProcessInfo = true
• includeLogData = true

The request is successfully sent, but the response always returns timestamps in UTC (+00:00) and doesn't seem to reflect the timeZone (auditTimestampText) or other body parameters i requested.

When I test this in Postman, I get the expected log results with localized timestamps and full data.

But when I configure the same request in Add-on Builder, the response seems incomplete or ignores the body parameters — especially timeZone.

reference for Samsung Knox API (https://docs.samsungknox.com/dev/knox-manage/api/#tag/Audit/operation/read)

Any information on how to debug this? or any workaround for this?

Thank you.

[PickleRick]

But is that parameter supposed to control the output or the input of the search time range?

[rayleigh29]

you mean the timeZone parameter?  

In Postman, setting timeZone=+07:00 actually changes the output field "auditTimestampText" to reflect the specified timezone — I get timestamps like 2025-10-31T23:18:00.663+07:00 instead of 2025-10-31T23:18:00.663+00:00 .

[PickleRick]

Well, since it's TLS and you can't just eavesdrop on the wire, unless there is a way to raise logging level for add-on builder (I'm not sure about that) the way to go to see what's actually being sent would be to set up a MITM proxy server.