[Powershell] [API] Delete endpoint by api fails with "invalid Operation"

Question

[Update: found workaround]] 
 I changed the script that it will produce a batch file with curl and execute this. result is that the endpoints are removed as wished. 
 [Edited due adding full script]] 
 Dear Community, 
 I run in an issue I do not understand. 
 I wrote a powershell script which should delete endpoints in a specific group. 
 Enabling/disabling tamper works (non-destructive script testing), but when I execute the delete, it always fails with 
 Invoke-RestMethod : { "error": "BadRequest", "correlationId": "d8889e3a-5914-4d68-bb5a-2765467c17d7", "requestId": "c78db0c0-6bf7-40e5-968b-510cd7cb1d6f" } At line:3 char:13 + $response = Invoke-RestMethod ' api-eu02.central.sophos.com/en ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand 
 
 The used command: 
 Invoke-RestMethod ' api-eu02.central.sophos.com/.../xxxxxx-xxx-45ed-9469-abe34def8ed9' -Method 'DELETE' -Headers $Headers 
 Anyone any idea? 
 the api token role is superadmin, so this should not be an issue. 
 [script] 
 
 I would love to hear your thoughts. 
 
 Regards, 
 Arno

Arno van der Veen - IT's Secured · Accepted Answer

My workaround is to create a batchfile (by powershell) and remove the entries with curl commands 
 $env:TOKEN=$script:Token
$env:sophosurl=$script:ApiHost
$env:sophosid=$script:ApiTenantId

 foreach ($id in $Central_Cleanup.items) {write-output ' d:\curl\bin\curl.exe --request DELETE $script:ApiHost/endpoint/v1/endpoints/$($id.id) --header "X-Tenant-ID: %sophosid%" --header "Authorization: Bearer %token%" --header "Accept: application/json"' >> $scriptlocation\removesophos.cmd} 
 start-process "$scriptlocation\removesophos.cmd"
 Remove-Item $scriptlocation\removesophos.cmd
 $env:TOKEN=0
 $XDRAPIHeaders=0

James Mackenzie · Answer

I just thought id reply to this as I had the same issue and came across your post, but since found the resolution to use Invoke-RestMethod. I found this only an issue for DELETE requests. 
 For some reason it doesnt accept this header "Content-Type" and gives a BadRequest: "Content-Type", 'application/json' 
 However if you define it with the word 'Accept' instead of 'Content-Type' then it works fine: "Accept", 'application/json' 
 I hope this helps someone who has the same issue.

[Powershell] [API] Delete endpoint by api fails with "invalid Operation"

Top Replies