SOAR: CrowdStrike OAuth API connector app error "Status Code: 403 Data from server: access denied, authorization failed"

Available Languages

Updated:September 29, 2026
Document ID:SPLK048743

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk SOAR Cloud Splunk SOAR On-Prem CrowdStrike OAuth API

Description

After configuring a CrowdStrike OAuth API connector app asset in SOAR, attempting to manually poll with 'Poll Now' function under 'Ingest Settings' may result in polling failures similar to below: 
App 'CrowdStrike OAuth API' started successfully (id: {ID_REDACTED}) on asset: 'crowdstrike - incidenttriage'(id: 13)
Loaded action execution configuration
Parameter ignored: "container_id"
In action handler for: on_poll
Using base url: https://api.crowdstrike.com
Connecting to https://api.crowdstrike.com...
Time taken: 0:00:01
Successfully added containers: 0, Successfully added artifacts: 0
1 action failed Error from server. Status Code: 403 Data from server: access denied, authorization failed

Investigation

These authentication errors maybe a result of correct API key permissions not being configured on the Crowdstrike environment, for 'Client ID' and 'Client Secret' configured under 'Asset Settings' in the CrowdStrike OAuth API app asset.

Resolution

Configure Event streams permissions for the API key on Crowdstrike for 'poll' to function as expected.

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco