How to Acknowledge Alerts via REST API

We are trying to send an Acknowledge REST API call to our Orion server from another system, however we can't seem to figure out how to format the JSON properly. I have found many posts on Thwack with examples but they all seem to be for the old alerting schema and don't seem to apply to what we are seeing as the arguments for the Acknowledge verb in SWQL Studio.

tdanner shows in this post here to send it with 4 different arguments: DefinitionId, ObjectType, ObjectId, and Notes. However, if you expand the Acknowledge verb under the "AlertsActive" entity in SWQL Studio you will see that the only two arguments needed is the AlertObjectIDs (which is an array of one or more ID's you can send) and the Notes argument.

Here is what we are trying to send in the body now and it's not working:

POST PrimaryOrionServer:17778/.../Acknowledge
[{"alertObjectIds":[{"ids":146735}], "notes":"Incident undefined created on undefined by ServiceNow System. I like Batman. He is kewl."}]

We think the problem is how we are formatting the alertObjectIds since, even though we are only wanting to acknowledge one Alert at a time, the argument is an array and thus should be formatted as one, correct?

Find more posts tagged with

swis

rest

Acknowledge

SWQL

Alerts

Accepted answers

tdanner

That post is from 2014 and uses the old API. Your json is close, but you need to remove the parameter names. Just send the values. Like this:

[ [ 146735 ], "Incident undefined..." ]

All comments

tdanner

That post is from 2014 and uses the old API. Your json is close, but you need to remove the parameter names. Just send the values. Like this:

[ [ 146735 ], "Incident undefined..." ]

xtraspecialj

Thank you so much for your prompt reply tdanner (as always). Now we are getting a 500 error. I've poured through the SWIS logs but can't find anything that would indicate why... Is the URL we are sending formatted correctly or is there something special we need to do to authenticate or anything?

tdanner

A 500 error with no details in the log is unexpected. Your URL looks fine. Authentication is regular HTTP Basic auth. You do need to send a "Content-Type: application/json" header, but if you miss that I think you get a different error.

What tool are you using to send the request?

xtraspecialj

Thanks once again for the help tdanner. There were two issues that were giving us problems once we followed your formatting for the JSON. We had left out the application/json in the content type header and our ServiceNow Mid server was completely backed up. We had recently upgraded ServiceNow and I guess its queues were backed up causing the REST calls it was trying to send to timeout. Once the queues got cleared we are now seeing alerts getting acknowledged with notes and everything. We are quite pleased.