Skip to main content
Question

Clarification on SOAR API Deprecation and Migration

  • March 27, 2026
  • 2 replies
  • 35 views

Abhix202
Forum|alt.badge.img

Hello,

I understand that legacy SOAR APIs are scheduled for deprecation and will no longer be available starting June. I need clarification on the following points:

  • What exactly qualifies as "legacy APIs" in this context?

  • Will the SOAR APIs currently listed in Swagger continue to function after the migration?

  • What specific changes are required on the client side to adapt to the new APIs?

My primary use case involves importing and exporting integrations and playbooks.

While inspecting the application, I noticed internal endpoints such as:
/api/external/v1/ide/ExportPackage/<INTEGRATION_NAME>

However, these endpoints are not documented in Swagger. Clarification is needed on whether:

  • These endpoints will remain supported, or

  • There are official alternative APIs available for these operations.

Additionally, attempts to use the newer APIs are resulting in 404 errors. Example:

curl -H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://chronicle.<region>.rep.googleapis.com/v1beta/projects/<project-id>/locations/<location>/instances/<instance-id>/playbooks"

This returns a 404 response indicating the resource is not found.

Clarification is required on:

  • The correct endpoints for playbook and integration management

  • Whether additional configuration or permissions are required

  • The migration path from legacy endpoints to supported APIs

Thank you.

2 replies

SoarAndy
Staff
Forum|alt.badge.img+12
  • Staff
  • March 27, 2026

Anything referenced by Swagger, and the swagger itself will be obselete, this will no longer reflect SecOps paltform at all.

For the API see this
https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/api-migration-guide
and this
https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/endpoint-mapping-table

in the new API guide some are marked as /legacy/, this states the entire API call might not be to the ‘normal’ Google structure, and might some day be changed, it doesn’t mean the API is being reitired just yet

HTH


Abhix202
Forum|alt.badge.img
  • Author
  • New Member
  • March 27, 2026

Hi Andy,

Thanks for providing the endpoint mapping table. While helpful, it doesn't seem to include the endpoints for importing integrations and playbooks into SOAR.

Upon inspecting the page, I noticed it uses the Swagger-related endpoints (e.g., /api/external/v1/ide/ExportPackage/<INTEGRATION_NAME>). Could you confirm the full list of these endpoints? We need them to finalize our CI/CD pipeline automation.