SOLVED

Azure Sentinel REST API update existing incident - version conflict error

%3CLINGO-SUB%20id%3D%22lingo-sub-1977319%22%20slang%3D%22en-US%22%3EAzure%20Sentinel%20REST%20API%20update%20existing%20incident%20-%20version%20conflict%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1977319%22%20slang%3D%22en-US%22%3E%3CP%3EAttempting%20to%20close%20an%20existing%20incident%26nbsp%3B%20using%20PUT%20REST%20Api%20for%20create%20%2Fupdate%20incident%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3Eusing%20this%20request%20body%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3Bproperties%3A%26nbsp%3B%7B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3Bseverity%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22High%22%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22classification%22%3C%2FSPAN%3E%3CSPAN%3E%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22Undetermined%22%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22classificationComment%22%3C%2FSPAN%3E%3CSPAN%3E%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22No%26nbsp%3Blonger%26nbsp%3Bin%26nbsp%3Berror%26nbsp%3Bstate%22%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3Bstatus%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22Closed%22%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3Btitle%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22Incident%20Title%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%7D%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7D%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3Ereturns%20this%20response%2C%20how%20do%20we%20handle%20versions%20on%20PUT%3F%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3E%7B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22error%22%3C%2FSPAN%3E%3CSPAN%3E%3A%26nbsp%3B%7B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22code%22%3C%2FSPAN%3E%3CSPAN%3E%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22Conflict%22%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22message%22%3C%2FSPAN%3E%3CSPAN%3E%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%22Newer%26nbsp%3Bversion%26nbsp%3Bof%26nbsp%3Bresource%26nbsp%3B'73.......ba8'%26nbsp%3Bexists.%26nbsp%3BData%26nbsp%3Bwas%26nbsp%3Bnot%26nbsp%3Bsaved%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7D%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1977560%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20REST%20API%20update%20existing%20incident%20-%20version%20conflict%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1977560%22%20slang%3D%22en-US%22%3EYou%20need%20to%20retrieve%20and%20provide%20the%20'etag'%20value%20in%20your%20put%20request.%3CBR%20%2F%3E%3CBR%20%2F%3ESo%20you%20need%20to%20do%20a%20get%20for%20the%20incident%20first%2C%20retrieve%20the%20'etag'%20property%20from%20there%20and%20then%20provide%20the%20etag%20value%20in%20your%20new%20request%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1980704%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20REST%20API%20update%20existing%20incident%20-%20version%20conflict%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1980704%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%20Thank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Attempting to close an existing incident  using PUT REST Api for create /update incident:

 
using this request body
 
{
  properties: {
    severity: "High",
     "classification""Undetermined",
     "classificationComment""No longer in error state",
    status: "Closed",
    title: "Incident Title"
  }
}
 
returns this response, how do we handle versions on PUT?
 
{
    "error": {
        "code""Conflict",
        "message""Newer version of resource '73.......ba8' exists. Data was not saved"
    }
}




2 Replies
best response confirmed by baddeacs (Occasional Contributor)
Solution
You need to retrieve and provide the 'etag' value in your put request.

So you need to do a get for the incident first, retrieve the 'etag' property from there and then provide the etag value in your new request