Webhook Authentication in Splunk SOAR 6.4.1

[soar_developer]

Hi all,

I'm working on a Splunk SOAR connector where we plan to add support for webhooks (introduced in SOAR v6.4.1), allowing the connector to receive data from external sources. I see there's an option to enable authentication for the webhook, but after enabling it, I'm unsure what type of information needs to be included in the request.

I've tried using basic authentication and an auth token, but neither worked. Could someone please guide me on what information should be included in the request once authentication is enabled?

[PrewinThomas]

@soar_developer 

when you enable authentication, it typically expects a ph-auth-token header.

Eg:
POST /rest/handler/<your_app>_<your_app_id>/... HTTP/1.1
Host: <your_soar_instance>
Content-Type: application/json
ph-auth-token: <your_generated_token>

Refer
#https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[soar_developer]

Hi @PrewinThomas , thanks for the reply.

I tried using the ph-auth-token, but it's not working.

It works for APIs like /rest/container/ and /rest/artifact/,
but not for the /webhook endpoint.

Ref: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-clou...