This is the API that I am using so the parameters are a little different. See API here: Get Endpoints (paloaltonetworks.com).
let
body = "{ ""request_data"": {}}",
GetJson = Json.Document(Web.Contents("https://[URI].paloaltonetworks.com/public_api/v1/endpoints/get_endpoint/",
[
Headers= [
#"Content-Type"="application/json",
#"x-xdr-auth-id"="Auth_ID",
#"Authorization"="API_KEY",
#"search_from"="100",
#"search_to"="100000"
],
Content=Text.ToBinary(body)
]
)),
reply = GetJson[reply],
endpoints = reply[endpoints],
#"Converted to Table" = Table.FromList(endpoints, Splitter.SplitByNothing(), null, null, ExtraValues.Error),
#"Expanded Column1" = Table.ExpandRecordColumn(#"Converted to Table", "Column1", {"endpoint_id", "endpoint_name", "endpoint_type", "endpoint_status", "os_type", "os_version", "ip", "users", "domain", "alias", "first_seen", "last_seen", "content_version", "installation_package", "active_directory", "install_date", "endpoint_version", "is_isolated", "isolated_date", "group_name", "operational_status", "operational_status_description", "scan_status", "content_release_timestamp", "last_content_update_time"}, {"endpoint_id", "endpoint_name", "endpoint_type", "endpoint_status", "os_type", "os_version", "ip", "users", "domain", "alias", "first_seen", "last_seen", "content_version", "installation_package", "active_directory", "install_date", "endpoint_version", "is_isolated", "isolated_date", "group_name", "operational_status", "operational_status_description", "scan_status", "content_release_timestamp", "last_content_update_time"})
in
#"Expanded Column1"
The search_from & search_to highlighted in red should be under request_data also highlighted in red at the top of the query.
The syntax to get that don't is the part that I am having trouble with.
