In today’s IT environments, automation and integration are essential components of an efficient workflow. Whether you’re managing cloud services, auditing system logs, or interacting with other online services, you’ll often need to access APIs. One of the key challenges is ensuring that these API requests are secure and authenticated.

In this post, we’ll walk through how to use PowerShell to send a request to an API endpoint while passing authentication headers, specifically using an API token for authorization.

Why Use PowerShell for API Requests?⌗

PowerShell is a powerful command-line shell and scripting language that’s widely used for automating administrative tasks. It also offers a rich set of commands for interacting with web services, such as Invoke-RestMethod, which allows you to make HTTP and HTTPS requests to RESTful APIs. I think most people would use curl, but curl is not always an option, for windows use cases PowerShell is perfect.

In this example, we’ll demonstrate how to use the Invoke-RestMethod command to authenticate using a token and retrieve audit logs from Dynatrace’s API.

Step-by-Step Guide to Sending API Requests with Authentication Headers⌗

1. Define the API Token and Authorization Headers⌗

APIs often require an API token to authenticate the request. The token acts as a key to prove that the request is coming from an authorized source. Here’s how you can include it in the headers of your API request.

$headers = @{
    Authorization = "Api-Token insert-your-api-token-here"
}

In this example, we are using the Authorization header with the value Api-Token, followed by the actual token (insert-your-api-token-here). Be sure to replace this token with the actual API token you obtain from your Dynatrace environment (or other API provider).

2. Define the API Endpoint (URI)⌗

Next, we need to specify the URL of the API endpoint we want to query. In this example, we’re fetching audit logs from Dynatrace, filtering for LOGIN events in the past week.

$url = "https://mySampleEnv.live.dynatrace.com/api/v2/auditlogs?filter=eventType(LOGIN)&from=now-1w"

Here, we’re using query parameters:

  • filter=eventType(LOGIN) filters the logs for login events.
  • from=now-1w specifies that we want to fetch logs from the past week.

Make sure to modify the URL based on the API you are working with, as well as the environment and filters you need.

3. Invoke the API Request⌗

Once you have the headers and URL defined, you can use the Invoke-RestMethod cmdlet to send the GET request to the API. PowerShell will handle the request and return the response.

$response = Invoke-RestMethod -Method Get -Uri $url -Headers $headers

The -Method parameter defines the type of HTTP request. Here, we’re using Get, but you could also use other HTTP methods like Post, Put, or Delete depending on the API. The -Uri parameter specifies the endpoint URL. The -Headers parameter passes our authorization header, which includes the API token.

4. Handle the API Response⌗

Once the request is sent, the response will be captured in the $response variable. This will contain the data returned by the API, such as the audit logs.

$response

Running this command will output the audit log information from Dynatrace, filtered according to the criteria defined in the URL.

Example Output⌗

Depending on your query, the response might look something like this:

{
    "logs": [
        {
            "timestamp": "2024-09-01T10:00:00Z",
            "eventType": "LOGIN",
            "username": "admin",
            "successful": true
        },
        {
            "timestamp": "2024-09-02T12:30:00Z",
            "eventType": "LOGIN",
            "username": "user123",
            "successful": false
        }
    ]
}

Final Thoughts⌗

Using PowerShell to interact with APIs is a powerful way to automate tasks, gather data, and streamline workflows. In this example, we’ve shown how easy it is to authenticate with an API using headers and an API token. You can adapt this approach to interact with many other APIs, making your scripts more dynamic and versatile.

Remember to always protect your API tokens, as they grant access to sensitive information. When working with public or shared repositories, avoid hardcoding tokens directly into your scripts. Instead, consider storing them in environment variables or secure vaults.