List Incident API for Microsoft Defender

Question

Hi,

I followed the page https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-create-app-web?view=o365-worldwide for getting the access token and when I am hitting the List Incident API https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-list-incidents?view=o365-worldwide I am getting below response, could you please help me to resolve the issue?

{
"error": {
"code": "Unauthorized",
"message": "Authorization has been denied for this request.",
"target": "e66f4d95-4ee7-4418-8d0e-7bd1a898a9f5"
}
}

Answer 1

Hi @Kishor ,

As per the documentation you need to have view permission for incidents in the portal when obtaining the token. Please validate the same.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.

Answer 2

Hello there,

In the ValuesController there is an attribute Authorize are you using this attribute?

If so then you must first register a user, and then login to get user's token, then you can use the token to authorize your self and get access .

------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--