The REST detector id in action INCIDENT_ID is invalid response when executing FlexResponse Smart Rule via REST API

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

You are trying to execute a FlexResponse Smart Rule (e.g. SMG release from quarantine) via REST API and you are getting the below response after POST on https://{{Enforce_IP}}/ProtectManager/webservices/v2/responseRules/execute:

{"status":400,"message":"REST API request validation failed.","i18nKey":{"i18nKey":"incidentRestApi.validation.error"},"detailedMessages":["The REST detector id in action INCIDENT_ID is invalid."],"detailedMessagesI18nKeys":[{"i18nKey":"responserule.detectorIdInvalid","parameters":{"0":INCIDENT_ID}}]}

Environment

16.X

Cause

For POST /responseRules/execute, there is no need to provide action field as this is needed only for response rules which needs to pass additional data.

Resolution

When you create a POST query, leave actions field empty. Example from POSTMAN below:

FlexResponse for SMG quarantine does not require additional parameters.