HELP: MCAS Rest API ignoring File Policy ID

Hi all:

I am hoping for some quick help here. I have a File policy that has matched >5000 items. I am trying to leverage the API to retrieve some basic information regarding the file matches. While I am able to do it with the MCAS PS cmdlets, I am trying to see if doing an API call will be faster but I am running into possible syntax or basic comprehension issues on my part.

The query is to return the files that matched to a particular file policy but the same logic used in the PS is not working with Invoke-RestMethod and I don't understand why. From my results, the filter portion is being ignored.

I stumbled on Mike Kassis video (https://channel9.msdn.com/shows/microsoft-security/microsoft-cloud-app-security--rest-apis-and-tokens) for initial guidance which helped alot

$token = "mytoken"

$body = @{

limit = '4'

filter = @{

policy = @{

cabinetmatchedrulesequals = '5f85c26e460319cd4539c894'

}

$response = Invoke-RestMethod -uri "https://mydomain.us.portal.cloudappsecurity.com/api/v1/files/" `

-Headers @{Authorization = "Token $token"} `

-Method Post `

-Body ($body | ConvertTo-Json -Depth 2) `

-Verbose