Forum Discussion
413 Request Entity Too Large error while updating watchlist
We are getting an error while using Watchlists API.
We are deleting the Watchlists and then creating the watchlists. While creating this watchlist, before it was giving the error "Cannot upload watchlist ''. Delete is currently in progress"
But from last week we are getting a different error pasted below. We need to resolve both errors as many customers are impacted cause of this.
We have tried with watchlist items as well rather than using watchlists but getting watchlist items only return 100 records at one time. This is timing out if lists are big.
FYI our largest list is around 1.5 MB and I see in the documentation that upto 3.8 MB is supported while pushing watchlists.
Here is the full error detail –
Encountered an unknown error while processing technology action - Error handling method 'AzureSentinelManagementClient updateWatchListForIntelPush due to [] with response status 413 and body 413 Request Entity Too Large
2 Replies
Sounds like you are hitting the limit to the size of the CSV that can be uploaded. Rather it would need to be added to a storage account first and then reference that location to access the CSV.
Thanks Gary for Reply,
413 error is resolved by itself, I am guessing some issue was there at tech but we are still getting below -
We are deleting the Watchlists and then creating the watchlists. While creating this watchlist, before it was giving the error "Cannot upload watchlist ''. Delete is currently in progress".
The limit as per documentation is less for watchlists apis, also while deleting or uploading watchlists its doing it in async process as per documentation https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/delete?view=rest-securityinsights-2025-03-01&tabs=HTTP
but not sure if there is a API for storage account?
