Creating Reports using Report Executions - Where do I find ID?

[cyberbeach33]

I'm trying to use the following code and don't know what it is looking for for id_list ='ID HERE' Can someone let me know how to specify (and find the ID). Thanks!

from falconpy import ReportExecutions

# Do not hardcode API credentials!
falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID HERE'

save_file = "some_file.ext"

response = falcon.get_download(ids=id_list)
open(save_file, 'wb').write(response)

[jshcodes]

Hi @cyberbeach33 -

ID HERE refers to the Report Execution ID for the specific execution (or run) of the Scheduled Report you are attempting to download.

You can retrieve this ID from the following operations:

• The report_executions_query operation. This operation will accept a filter in FQL syntax to query for a specific report execution (or list of executions).

• The scheduled_reports_get operation. This operation will return a branch called last_execution as part of the response. This dictionary will contain the ID of the last report execution for the specific scheduled report returned.

  You will need to construct an instance of the Scheduled Reports Service Class in order to access this operation.

[cyberbeach33]

@jshcodes You are an animal with this stuff. Thanks for the rapid responses. Is there a specific access required from the API Client keys to be able to query reports? I'm getting "access denied" "Invalid bearer token". Also, is there a place to find what permissions are required for each falconpy function?

[jshcodes]

Hi @cyberbeach33 -

You will need the Scheduled Reports scope (READ) assigned to the API client in order to access these operations. 😄

Most service collections (and therefore Service Classes) align to a scope, but there are several that encompass more than one. There are also READ / WRITE authorization requirements depending on the operation used. This is a good documentation enhancement suggestion, we'll add an issue for it.