Skip to main content
Question

Google Chronicle SecOps Standard Cases API: "empty key in header" 500 error (Legacy API works fine)

  • October 9, 2025
  • 7 replies
  • 168 views
imanachyn
Forum|alt.badge.img

Hey. I'm trying to use the Google Chronicle Security Operations standard Cases API (`v1alpha/cases`), but I consistently get a `500 Internal Server Error` with the message **"there is an empty key in the header"**. However, the legacy API (`legacy:legacyBatchGetCases`) works perfectly with the exact same authentication and headers.

Has anyone successfully used the standard Cases API? What am I missing?
 

What Works (Legacy API)

https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyBatchGetCases?rep_location=us

curl -H "Authorization: Bearer ${TOKEN}" \

"https://chronicle.us.rep.googleapis.com/v1alpha/projects/{project}/locations/us/instances/{instance}/legacy:legacyBatchGetCases?names="

 

Response:

{

"cases": []

}

✅ Success! Status 200

 

What Doesn't Work (Standard API)

 

This fails with 500 error:

curl -H "Authorization: Bearer ${TOKEN}" \

"https://chronicle.us.rep.googleapis.com/v1alpha/projects/{project}/locations/us/instances/{instance}/cases"

 

Response:

{
  "error": {
    "code": 500,
    "message": "there is an empty key in the header",
    "status": "INTERNAL"
  }
}

 

The same error for all case APIs

mbailly

7 replies

kentphelps
Staff
Forum|alt.badge.img+11
  • kentphelps
  • Staff
  • October 10, 2025

Try adding Content-Type: application/json to your curl command:
 

curl -H "Authorization: Bearer ${TOKEN}" \
     -H "Content-Type: application/json" \
     "https://chronicle.us.rep.googleapis.com/v1alpha/projects/{project}/locations/us/instances/{instance}/cases"

 

mbailly
  • mbailly
  • New Member
  • October 13, 2025

Hi there,

I am currently experiencing the exact same issue. Same “there is an empty key in the header” error for all “cases” endpoints.

  • I am using the “eu” location
  • My service account has the required permissions
  • I have tried multiple REST clients
  • Providing a “Content-Type” header does not seem to help
imanachyn
imanachyn
Forum|alt.badge.img
  • imanachyn
  • Author
  • New Member
  • October 13, 2025

Unfortunately, adding a headers “Content-Type”, “Accept” didn't help. It looks like a SOAR API to Chronicle API issue. Some endpoints work, but the SOAR API related ones don't seem to

SoarAndy
Staff
Forum|alt.badge.img+12
  • SoarAndy
  • Staff
  • October 17, 2025

The new API (v1alpha) for SOAR data (e.g. Cases) whilst documented, is not in the product yet, so even if you get past this (which might not be possible) there are likely other errros.

 

I believe the current hope is that it can be rolled out Oct/Nov so until then you might want to use the old API. 


HTH
Andy

KennyG
KennyG
  • KennyG
  • New Member
  • October 30, 2025

I am just starting to do some API development and ran into this same error.  Very helpful post.  What is the old API?  I was using 

https://chronicle.us.rep.googleapis.com for my requests that got the error above
 
Is the old API 
https://backstory.googleapis.com and where is the documentation for it. 
tvwdj
  • tvwdj
  • New Member
  • November 6, 2025

The new API (v1alpha) for SOAR data (e.g. Cases) whilst documented, is not in the product yet, so even if you get past this (which might not be possible) there are likely other errros.

 

I believe the current hope is that it can be rolled out Oct/Nov so until then you might want to use the old API. 


HTH
Andy

Hi Andy,

I was wondering is there a exact time and date when this is going to be enrolled? Then i don't have to guess when i want to implement the new API.

Kind regards,
Tom van Wendel de Joode

SoarAndy
Staff
Forum|alt.badge.img+12
  • SoarAndy
  • Staff
  • November 6, 2025

Sorry Tom I don’t have specific information.  I think it will be 2025 though if that helps, keep an eye on release notes, community announcments, etc

 

Andy

Terms & ConditionsCookie settingsAccessibility statement
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.