why this code doesnt work???

[NSH531]

code:

    falcon = falconpy.HostGroup(client_id=client_id,                   client_secret=secret
                   )
    if(os=="1"):
        os="Workstation"
    elif(os=="2"):
        os="Server"
    elif(os=="3"):
        os="Domain Controller"
    else:
        os=""
        
    response = falcon.create_host_groups(assignment_rule=f"product_type:'{os}'",
                                         description="string",
                                         group_type="static",
                                         name=f"{os}  {Random.randint(self=r, a=0,b=120)} tests"
                                         )
    
    PARAMS = {
        "action_name": "add-hosts"     # Can also pass this using the action_name keyword
    }

    # Only one ID may be updated at a time
    BODY = {
       
         "action_parameters": [
        {
            "name": "filter",
            "value": f"product_type:'{os}'"
        }
    ],
            "ids": response['body']

        }

    respownse = falconpy.APIHarness(client_id=client_id,client_secret=secret).command("performGroupAction", parameters=PARAMS, body=BODY)
    return respownse

[NSH531]

and I got this:
{"body":{"errors":[{"code":500,"message":"Internal Server Error: Please provide trace-id='d020fa1c-4fed-4732-a77e-915345712e0f' to support"}],"meta":{"powered_by":"crowdstrike-api-gateway","query_time":9.8e-08,"trace_id":"d020fa1c-4fed-4732-a77e-915345712e0f"}},"headers":{"Connection":"keep-alive","Content-Length":"292","Content-Type":"application/json","Date":"Tue, 02 Aug 2022 07:15:42 GMT","Server":"nginx","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Content-Type-Options":"nosniff","X-Cs-Traceid":"d020fa1c-4fed-4732-a77e-915345712e0f","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"status_code":500}

[jshcodes]

This looks to be a formatting issue in the payload for the second API operation. We're setting the value of ids to be response['body'], but this is not a list, it's a dictionary. If we want to pass the return from our first API call to the second, we need to pass the resources array.

BODY = {
         "action_parameters": [
        {
            "name": "filter",
            "value": f"product_type:'{os}'"
        }
        ],
        "ids": response['body']['resources']
}

I'm a little confused as to why we're using the Uber Class to perform the second call. Since we are already working with the Host Group Service Class (the object named falcon), you should be able to execute the following instead:

# You should check the content of the resources array to confirm results are returned
# Only one ID can be passed to this operation.
respownse = falcon.perform_group_action(ids=response['body']['resources'][0], action_name="add-hosts", filter=f"product_type:'{os}'")

This not only reduces code complexity, but reduces the number of calls made to authenticate and retrieve a token.