I found a way to do this but not using the API key. By reproducing the login as is done on the web interface using the admin login detail. I'm not sure if that is going to be of any help.
Call it with `the_script.sh <hostname> admin_email_address`
At the prompt, type the admin password.
#!/bin/sh
hostname=$1
email_address=$2
#password=$3
echo "Password:"
read password
session=$(curl -k -i -s -X POST "https://${hostname}/rest/session?include_permissions=false" -H 'Content-Type: application/json' --data-raw "{\"email\": \"${email_address}\",\"password\": \"${password}\"}")
body=$(echo $session|sed 's/[^{]*//')
echo "$session" > /tmp/session
jsessionid=$(cat /tmp/session |grep JSESSIONID|cut -d "=" -f2|cut -d ";" -f1)
#echo "JESSIONID: $jsessionid"
csrf_token=$(echo -n -e "${body}"|jq .csrf_token|sed 's/\"//g')
CSRF=$(echo $csrf_token| xxd -p -c 180 )
#echo "X-sess-id: ${csrf_token}"
#echo "CSRF: ${CSRF}"
curl -k -s -X POST "https://${hostname}/rest/system/usage" \
-H 'Content-Type: application/json' \
-H "X-sess-id: ${csrf_token}" \
-H "Cookie: JSESSIONID=${jsessionid}; CSRF_TOKEN=${CSRF}" \
--data-raw '{"start_date":1725148800000,"end_date":1759276799999,"metric_type":"authorized_user","period_type":"month"}'|jq .
------------------------------
YANNICK LAVANANT
------------------------------
Original Message:
Sent: Thu September 04, 2025 09:57 AM
From: Juan Cruz Del Col
Subject: Issue accessing POST /system/usage endpoint via REST API for external dashboard
We need to access the REST API endpoint POST /system/usage in order to retrieve usage data.
With the data obtained, we intend to design a management dashboard outside of SOAR.
We are performing the tests using Postman, but we consistently receive a 401 Unauthorized error. However, when we query other API endpoints such as GET /orgs/{org_id}/incidents/{inc_id}, it works correctly.
{
"success": false,
"title": null,
"message": "Internal Server Error",
"hints": [],
"error_code": "generic"
}
We tested using API users with full permissions, and also tried with a nominal user assigned as Master Admin. Additionally, we granted this nominal user Sysadmin permissions.
Any guidance or documentation on how to properly authenticate or configure access to this specific endpoint would be greatly appreciated.
------------------------------
Juan Cruz Del Col
------------------------------