[Powershell] [API] Delete endpoint by api fails with "invalid Operation"

what headers are you sending up? Do any other API requests work for you?

Hi Richard,

Other Api requests do work within the same script

The header is combined by: 

# SOPHOS API Headers:
$XDRAPIHeaders = @{
	"Authorization" = "Bearer $script:Token";
	"X-Tenant-ID" = "$script:ApiTenantId";
    "Content-Type" = "application/json";
}

The part of authentication and header creation I got from here: https://community.sophos.com/intercept-x-endpoint/f/recommended-reads/131161/using-powershell-to-extract-the-detections-information-from-the-datalake

    ###################################################################################################################################
    # Find machines in the assigned group
    ###################################################################################################################################
    Write-Host("`n=================================================================")
    Write-Host("[Sophos Central device removal] This script checks existing")
    Write-Host(" machines, enumerate them and removes them.")
    Write-Host("=================================================================")
   

    $Central_Cleanup = (Invoke-RestMethod -Method Get -Uri $script:ApiHost"/endpoint/v1/endpoints?groupNameContains=$($SophosDevicegroup)" -Headers $XDRAPIHeaders)
                


    
        $Central_Cleanup = (Invoke-RestMethod -Method Get -Uri $script:ApiHost"/endpoint/v1/endpoints?groupNameContains=$($SophosDevicegroup)" -Headers $XDRAPIHeaders -ErrorAction SilentlyContinue -ErrorVariable ScriptError)   
        

    
        # Display results in the console
        $Central_Cleanup.items | Format-Table -Property id, hostname, lastSeenAt, tamperProtectionEnabled


 
    ###################################################################################################################################
    # set or remove tamperprotection in the assigned group (enable = true; disable = false
    ###################################################################################################################################
      
      foreach ($id in $Central_Cleanup.items) { (Invoke-RestMethod -Method 'Post' -Uri $script:ApiHost"/endpoint/v1/endpoints/$($id.id)/tamper-protection" -Headers $XDRAPIHeaders -Body '{"enabled": false}' )    }

    ###################################################################################################################################
    # Delete machines in the assigned group
    ###################################################################################################################################

     foreach ($id in $Central_Cleanup.items)  {Invoke-RestMethod -Method Delete -Uri $script:ApiHost"/endpoint/v1/endpoints/$($id.id)"  -Headers $XDRAPIHeaders -debug -ErrorAction SilentlyContinue -ErrorVariable ScriptError} 

}

I tried with the original API guide (https://developer.sophos.com/docs/endpoint-v1/1/routes/endpoints/%7BendpointId%7D/delete) syntax as well as the syntax offered by postman/sophos api (urn:uuid:[endpointID]). unfortunally no difference in outcome.

My workaround is to create a batchfile (by powershell) and remove the entries with curl commands

$env:TOKEN=$script:Token
$env:sophosurl=$script:ApiHost
$env:sophosid=$script:ApiTenantId

     foreach ($id in $Central_Cleanup.items)  {write-output ' d:\curl\bin\curl.exe --request DELETE $script:ApiHost/endpoint/v1/endpoints/$($id.id) --header "X-Tenant-ID: %sophosid%" --header "Authorization: Bearer %token%" --header "Accept: application/json"' >> $scriptlocation\removesophos.cmd} 
     start-process "$scriptlocation\removesophos.cmd"
     Remove-Item $scriptlocation\removesophos.cmd
     $env:TOKEN=0
     $XDRAPIHeaders=0

My workaround is to create a batchfile (by powershell) and remove the entries with curl commands

$env:TOKEN=$script:Token
$env:sophosurl=$script:ApiHost
$env:sophosid=$script:ApiTenantId

     foreach ($id in $Central_Cleanup.items)  {write-output ' d:\curl\bin\curl.exe --request DELETE $script:ApiHost/endpoint/v1/endpoints/$($id.id) --header "X-Tenant-ID: %sophosid%" --header "Authorization: Bearer %token%" --header "Accept: application/json"' >> $scriptlocation\removesophos.cmd} 
     start-process "$scriptlocation\removesophos.cmd"
     Remove-Item $scriptlocation\removesophos.cmd
     $env:TOKEN=0
     $XDRAPIHeaders=0