Error in SOAR Connection establishment

[Ramachandran]

Hey everyone, I'm trying to configure a new server in the SOAR UI, but I'm running into this error:
Error Message:
There was an error adding the server configuration.
On SOAR: Verify server's 'Allowed IPs' and authorization configuration.

Status: 500
Text: JSON reply had no "payload" value
I've already double-checked the basic config, but still no luck. From what I understand, this might be related to:
Missing or misconfigured
Allowed IPs on the SOAR server
Improper authorization settings
Possibly an issue with the server not returning the expected JSON format
Has anyone faced this before or have any ideas on how to troubleshoot this?
Any guidance or checklist would be super helpful
Thanks in advance!

[livehybrid · Accepted solution]

Hi @Ramachandran 

Are you running ES and SOAR On-Premise? Please could you confirm the versions you are using.

You mentioned that connectivity is in place between the installations - please could you verify that the correct "Allowed IP" was used when setting up your service user (https://docs.splunk.com/Documentation/SOARonprem/latest/Admin/Users#:~:text=Create%20an%20automation...

Failing this you might want to look at temporarily disabling SSL validation to rule out SSL issues (https://docs.splunk.com/Documentation/PhantomApp/4.0.10/Install/ConfigureCerts#:~:text=Admin%20Manua...) - Note: Even though you see a 500 error, this isnt necessarily a 500 code from SOAR (which would imply SSL is fine), its from the API endpoint in Splunk which reaches out to SOAR. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@Ramachandran  

Try curl or Postman to call the server's API endpoint directly. Check if the response includes a valid payload. 

curl -X GET https://<server-endpoint> -H "Authorization: Bearer <token>"

Ensure the server’s response matches the format Splunk SOAR expects. Use a JSON validator to confirm syntax and structure.

Ensure there are no network restrictions (e.g., firewalls, proxies) blocking communication between Splunk SOAR and the server.