> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Netskope
> The connection allows AirMDR to authenticate to Netskope and run the configured integration skills. Available operations depend on the skills supported by AirMDR and the permissions assigned in Netskope.
This guide explains how to retrieve your Netskope **Tenant URL**, generate an **API Token**, and enter these credentials in AirMDR.
Connect Netskope to AirMDR using your Tenant URL and API Token to enable supported security investigations and automated workflows.
Netskope provides two token creation workflows. Tenants with **RBAC V3** enabled use **Service Account** under **Administrators & Roles**.
The **Settings → Tools → REST API v2** path shown in the AirMDR connection screen applies to the legacy workflow.
After RBAC V3 activation, new tokens must use the service account workflow.
| Component | Applicability |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Netskope platform | A Netskope tenant exposing the API endpoints required by the integration. |
| API version | This guide covers Netskope REST API v2 authentication. |
| RBAC V3 tenants | Generate an API token through a service account. |
| Tenants using legacy token management | Generate a token from **Settings → Tools → REST API v2**, while this option remains available. |
| AirMDR integration version | Confirm the supported connector release and tested Netskope compatibility with the AirMDR Integration team. |
The connection requires two values:
| Field | Description | Where to obtain it | Example |
| -------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------- |
| **Tenant URL** | HTTPS base address of your Netskope tenant. | Browser address bar after signing in to the Netskope administration console. | `https://example.goskope.com` |
| **API Token** | Secret credential used to authenticate API requests. | Service account creation in RBAC V3, or the legacy REST API v2 token page. | `` |
The token is included in each request using this HTTP header: `Netskope-Api-Token: `
Netskope documents this header for REST API v2 requests.
Enter only the generated token in AirMDR’s **API Token** field. Do not include the header name, quotation marks, or a `Bearer` prefix.
**Role-based access considerations**
* **RBAC V3:** A Tenant Admin manages administrators and roles. Assign the integration service account a role containing only the required permissions. [Netskope Administrators RBAC V3](https://docs.netskope.com/en/administrators-rbac-v3?utm_source=chatgpt.com)
* **Legacy workflow:** Configure access for individual endpoints when creating the token.
* Grant read access for retrieval operations. Grant write access only where a supported skill changes Netskope data or configuration.
The following are **endpoint examples**, not a confirmed AirMDR permission list:
| Example operation | Netskope endpoint | Legacy token privilege |
| --------------------------- | ---------------------------------------------- | ---------------------- |
| Retrieve alert events | `/api/v2/events/dataexport/events/alert` | Read |
| Retrieve application events | `/api/v2/events/dataexport/events/application` | Read |
| Retrieve audit events | `/api/v2/events/dataexport/events/audit` | Read |
Netskope documents these endpoint privileges in its API token scope reference. Use only those required by the integration.
## Pre-requisites
>
> An active Netskope tenant with access to the required API features.
>
>
>
> Netskope administrator access to create API credentials and assign permissions.
>
## Setup Steps
1. Open your organization’s Netskope administration console.
2. Sign in with your administrator account.
3. After authentication completes, select the browser address bar.
4. Copy the HTTPS scheme and tenant hostname.
5. Remove any page path, query parameters, or fragment.
For example:
| Browser address | Value to enter in **Tenant URL** |
| -------------------------------------------- | -------------------------------- |
| `https://example.goskope.com/` | `https://example.goskope.com` |
6. Retain the exact hostname assigned to your tenant.
Netskope assigns the Tenant URL when provisioning the tenant. You retrieve this value; you do not generate it. Do not append `/api/v2`, a login path, or an API endpoint to the AirMDR **Tenant URL** field.
Netskope uses different token generation methods depending on whether your tenant has **Role-Based Access Control (RBAC) V3** enabled. Follow the method available in your tenant.
| Method | When to Use It | How Permissions Are Assigned |
| -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| [**RBAC V3 — Service Account**](https://docs.airmdr.com/Integrations/Netskope#rbac-v3-—-service-account) | Your tenant uses RBAC V3. Create the token under **Settings → Administration → Administrators & Roles → Administrators → Service Account**. | Permissions come from the role assigned to the service account. |
| [**Legacy — REST API v2**](https://docs.airmdr.com/Integrations/Netskope#legacy-—-rest-api-v2) | Your tenant still allows **New Token** creation under **Settings → Tools → REST API v2**. | Select the required API endpoints and privileges when creating the token. |
Complete only the applicable method. After RBAC V3 is enabled, use the **Service Account** method for new tokens. Both methods generate credentials for accessing Netskope REST API v2.
#### **RBAC V3 — Service Account**
Use this procedure when your tenant provides the **Service Account** option.
Ask a Netskope Tenant Admin to complete account and role provisioning.
1. Open **Settings → Administration → Administrators & Roles**.
2. Ensure an appropriate integration role exists with the permissions required by the AirMDR skills. If not create a dedicated role.
Create a role to define the permissions available to the AirMDR service account.
Sign in to Netskope with the predefined **Tenant Admin** role.
1. Navigate to **Settings → Administration > Administrators & Roles**.
2. Select the **Roles** tab.
3. Click **New**.
4. Enter the role details:
| Field | Example |
| :-------------- | :--------------------------------------------------------------- |
| **Name** | `AirMDR-Integration-Role` |
| **Description** | `Permissions required for the Netskope integration with AirMDR.` |
5. Select the **functional areas** required by the AirMDR skills you intend to use.
6. Review the functions and permissions displayed below the selected areas. Netskope automatically selects associated permissions; adjust them to retain only the required access and dependencies.
7. Click the **information icon** beside a permission set to check its associated API endpoints. Confirm that it includes the methods and endpoints required by your skills.
8. If applicable, configure **Scope** and **Obfuscation** to control which records and fields the integration can access.
9. If your organization requires IP restrictions, open **IP Allowlist** and add the approved outbound IP addresses used by AirMDR or its Remote Agent.
10. Click **Save**.
11. Confirm that `AirMDR-Integration-Role` appears in the **Roles** list.
| Skill / Skill ID | RBAC V3 permission mapping |
| :------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Netskope Search Alerts** — `search_netskope_alerts.py` | **Events & Analytics → Alerts → View** is the applicable function mapping. Verify that its associated APIs include this exact endpoint. |
| **Netskope Search DLP Events** — `search_netskope_dlp_events.py` | **Alerts → View** and **Application Events → View** for those respective event types. The exact function mapping for `epdlp` and `incident` requires tenant verification. Do not assume Alerts access covers all four. |
| **Netskope Get DLP Incident Details** — `get_netskope_dlp_incident_details.py` | **DLP → DLP Incident → View** is the documented starting permission. Confirm that both subresources are covered and whether forensic content requires an additional content-access permission. |
| **Netskope Search Audit Events** — `search_netskope_audit_events.py` | **Administration → Audit Log → View**. Verify the exact API association. |
| **Netskope Get Device Status** — `get_netskope_device_status.py` | Grant access through the permission set whose associated APIs include this endpoint. **The exact RBAC function name and minimum level were not verified in the public sources reviewed.** |
| **Netskope Check URL List** — `check_netskope_url_list.py` | **Access Control → URL List → View** is the proposed minimum for this retrieval-only operation. Confirm GET coverage in the tenant. The listed operation does not justify permission to modify or apply URL lists. |
| **Netskope Get NPA Policies** — `get_netskope_npa_policies.py` | **Real-time Protection → NPA Policy → View**, with **Policy Group → View** as a documented dependency. Confirm the API associations in the tenant. |
| **Netskope Export Transaction Events** — `export_netskope_transaction_events.py` | **Events & Analytics → Page Events → View** and/or **Application Events → View**, matching the selected types. |
| **Netskope Get User Blast Radius** — `get_netskope_user_blast_radius.py` | **View** on each corresponding event function. For example, querying alerts and application events requires access to both. **The complete permission list depends on the skill’s supported event types.** |
| **Netskope Get CCI Score** — `get_netskope_cci_score.py` | Netskope’s published setup specifies **CCI → Manage**, while the same article also mentions CCI read access. **The minimum permission for this specific GET operation remains unresolved.** See the CCI note below. |
| **Netskope Get Data Export Events** — `get_netskope_dataexport_events.py` | **View** on the corresponding event or alert functions. Audit exports map to **Audit Log**; application exports map to **Application Events**. Verify every selected type separately. |
3. Select the **Administrators** tab.
4. Click **Service Account**.
5. Enter a descriptive service account name, such as: `AirMDR-Integration-Role`
6. Select the approved role from the **Role** dropdown.
7. Configure REST API token generation and enter the expiration period in days.
8. Leave the option to generate the token later unselected.
9. Click **Create**.
10. Copy the generated API token immediately and store it in an approved secrets manager.
**The token is displayed only once.**
**Copy and securely save the API Token in your designated Password Manager or Vault.**
**It cannot be retrieved after the creation screen is closed.**
#### **Legacy — REST API v2**
Use this procedure only when token creation remains available under **REST API v2**.
1. Open **Settings > Tools > REST API v2**.
2. Check **REST API Status**.
3. If disabled, click the pencil icon, enable REST API access, and click **Save**.
4. Click **New Token**.
5. Enter a token name, such as `AirMDR-Integration`.
6. Select an expiration period aligned with your organization’s credential policy.
7. Click **Add Endpoint**.
8. Select the endpoints confirmed for the AirMDR integration.
9. Assign the required privileges to each endpoint:
* **Read** for supported retrieval operations.
* **Read + Write** where modification operations are required.
10. Click **Save**.
11. On the confirmation page, click **Copy Token**.
12. Store the token securely, then click **OK**.
**The token is displayed only once.**
**Copy and securely save the API Token in your designated Password Manager or Vault.**
**It cannot be retrieved after the creation screen is closed.**
## Netskope Credential Reference Table
| AirMDR Field | What to Enter | Where to Get It in the Netskope UI | Example |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
| **Tenant URL** | Your Netskope tenant’s HTTPS base URL. Include `https://` and the complete hostname. Exclude console page paths, query parameters, and `/api/v2`. | Sign in to the **Netskope administration console** and copy the base URL from the browser address bar. Preserve your tenant’s regional hostname, if present. | `https://example.goskope.com` |
| **API Token** | The complete API token generated for the integration, with permissions required by the enabled AirMDR skills. Enter only the token value. | **RBAC V3:** Go to **Settings → Administration → Administrators & Roles → Administrators → Service Account**. Select the appropriate role, generate the token, and copy it after creation.
**Legacy tenants:** Go to **Settings → Tools → REST API v2 → New Token**, configure endpoint permissions, save, and select **Copy Token**. | `` |
The Tenant URL is assigned to your organization; it is not generated during integration setup. Copy and securely store the API token when it is displayed.
Do not include `Bearer`, `Netskope-Api-Token:`, or quotation marks in the **API Token** field.
## Validate Connectivity
Use a read-only endpoint that the token is permitted to access. The example below queries alert records through Netskope’s **Datasearch API**.
The token or service account role must permit `GET /api/v2/events/datasearch/alert`. Permission for a Dataexport endpoint does not automatically establish permission for this endpoint.
1. Open a Bash terminal on an approved system.
2. Run the following commands, replacing the example Tenant URL:
````text theme={null}
```text
NETSKOPE_TENANT_URL="https://example.goskope.com"
read -r -s -p "Enter Netskope API token: " NETSKOPE_API_TOKEN
printf '\n'
NETSKOPE_END_TIME="$(date +%s)"
NETSKOPE_START_TIME="$((NETSKOPE_END_TIME - 3600))"
curl --silent --show-error \
--get "${NETSKOPE_TENANT_URL}/api/v2/events/datasearch/alert" \
--header "Netskope-Api-Token: ${NETSKOPE_API_TOKEN}" \
--header "Accept: application/json" \
--data-urlencode "starttime=${NETSKOPE_START_TIME}" \
--data-urlencode "endtime=${NETSKOPE_END_TIME}" \
--data-urlencode "limit=1" \
--write-out '\nHTTP status: %{http_code}\n'
unset NETSKOPE_API_TOKEN
```
````
3. Confirm that the HTTP status is `200` and the response reports `status.execution` as `SUCCESS`.
```text theme={null}
{
"result": [],
"status": {
"execution": "SUCCESS",
"count": 0,
"message": "Executed Successfully",
"status_code": 200
}
}
```
4. Review any error message before retrying.
## Configure Netskope in AirMDR Integrations Dashboard
1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **ADMIN → Integrations**.
3. Use the search option, enter the keyword "**Netskope**", select the **Connections** tab, and click **+ New Connection** button.
4. Use the following values in the AirMDR integration configuration screen:
| Field | Value |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Instance** | A descriptive name, such as `Netskope-Production`. |
| **Organization** | Select the organization that owns the connection. |
| **Description** | For example, `Netskope connection for security investigation workflows`. |
| **Tenant URL** | Paste the tenant base URL from Step 1. |
| **API Token** | Paste the token generated in Step [3](https://docs.airmdr.com/Integrations/Netskope#rbac-v3-—-service-account) or [4](https://docs.airmdr.com/Integrations/Netskope#legacy-—-rest-api-v2). |
1. **In Remote Agent**, select an AirMDR Remote Agent when access to your Netskope tenant requires an approved proxy or controlled outbound network route. If Netskope IP allowlisting is enabled, ensure the selected runtime’s outbound IP address is permitted. Otherwise, leave this field unselected unless instructed by your AirMDR administrator.
2. **In Expiry**, select the date on which AirMDR should treat the stored Netskope credentials as expired, according to your organization’s credential-rotation policy. Set this date no later than the API token’s expiration in Netskope.
The **Expiry** setting in AirMDR does not extend, rotate, or revoke the Netskope API token. Before the token expires, generate a replacement using the applicable Netskope token-generation method, update the **API Token** in AirMDR, and validate the connection. Revoke the previous token after confirming that all integrations using it have been updated.
5. Click **Save**.
## Skills provided by this Integration
The Netskope integration provides **investigation, device and application assessment, policy review, and event retrieval skills** to help security teams investigate activity, assess potential impact, and review Netskope security information.
Search alerts, examine DLP incidents, review audit activity, and assess the potential impact of user activity.
| Skill | Skill ID | Purpose |
| ------------------------------------- | -------------------------------------- | ----------------------------------------------------------------------------------------- |
| **Netskope Search Alerts** | `search_netskope_alerts.py` | Searches Netskope alerts to support security investigations. |
| **Netskope Search DLP Events** | `search_netskope_dlp_events.py` | Searches supported event types for DLP-related file-hash activity. |
| **Netskope Get DLP Incident Details** | `get_netskope_dlp_incident_details.py` | Retrieves notes and forensic information associated with a DLP incident. |
| **Netskope Search Audit Events** | `search_netskope_audit_events.py` | Retrieves audit records to investigate administrative activity. |
| **Netskope Get User Blast Radius** | `get_netskope_user_blast_radius.py` | Queries user-related events to help identify potentially affected activity and resources. |
PingID's `GetUserDetails` operation is part of the User Management API and returns user status and device details.
Retrieve device status and application risk information to support investigation and assessment.
| Skill | Skill ID | Purpose |
| ------------------------------ | ------------------------------- | ------------------------------------------------------------------------------------------------------ |
| **Netskope Get Device Status** | `get_netskope_device_status.py` | Retrieves device and Netskope client status records. |
| **Netskope Get CCI Score** | `get_netskope_cci_score.py` | Retrieves application Cloud Confidence Index (CCI) information to support application risk assessment. |
Review configured URL lists and Netskope Private Access policies.
| Skill | Skill ID | Purpose |
| ----------------------------- | ------------------------------ | --------------------------------------------------------------------------------- |
| **Netskope Check URL List** | `check_netskope_url_list.py` | Retrieves configured URL lists and checks for matching entries within the skill. |
| **Netskope Get NPA Policies** | `get_netskope_npa_policies.py` | Retrieves Netskope Private Access (NPA) rules and, when requested, policy groups. |
Retrieve event records for analysis and use in AirMDR workflows.
| Skill | Skill ID | Purpose |
| -------------------------------------- | --------------------------------------- | --------------------------------------------------------------------------------- |
| **Netskope Export Transaction Events** | `export_netskope_transaction_events.py` | Retrieves page or application event records through the Datasearch API. |
| **Netskope Get Data Export Events** | `get_netskope_dataexport_events.py` | Retrieves supported event or alert records through Dataexport iterator endpoints. |
To view the details of Input Parameters and Output for the respective skills
* Go to [AirMDR → Netskope](https://app.airmdr.com/integrationsv2/5399858e-f534-48c0-a5f3-e4b4409ab507/skills?search=netskope) Integration page.
* Select the **Skills** tab and click on the required listed skills.
### **Required Permission Summary**
| Skill / Skill ID | Purpose | Required endpoint access — legacy token | RBAC V3 permission mapping |
| -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Netskope Search Alerts** — `search_netskope_alerts.py` | Searches Netskope alerts for investigation. | **Read:** `GET /events/data/alert` | **Events & Analytics → Alerts → View** is the applicable function mapping. Verify that its associated APIs include this exact endpoint. |
| **Netskope Search DLP Events** — `search_netskope_dlp_events.py` | Searches supported event types for DLP-related file-hash activity. | **Read** on each queried path under `/events/datasearch/`: `alert`, `application`, `epdlp`, and/or `incident`. | **Alerts → View** and **Application Events → View** for those respective event types. The exact function mapping for `epdlp` and `incident` requires tenant verification. Do not assume Alerts access covers all four. |
| **Netskope Get DLP Incident Details** — `get_netskope_dlp_incident_details.py` | Retrieves an incident’s notes and forensic information. | **Read on both:** `GET /incidents/dlpincidents/{id}/notes` and `GET /incidents/dlpincidents/{id}/forensics`. | **DLP → DLP Incident → View** is the documented starting permission. Confirm that both subresources are covered and whether forensic content requires an additional content-access permission. |
| **Netskope Search Audit Events** — `search_netskope_audit_events.py` | Retrieves audit records for administrative activity investigations. | **Read:** `GET /events/data/audit` | **Administration → Audit Log → View**. Verify the exact API association. |
| **Netskope Get Device Status** — `get_netskope_device_status.py` | Queries device/client status records. | **Read:** `GET /events/datasearch/clientstatus` | Grant access through the permission set whose associated APIs include this endpoint. **The exact RBAC function name and minimum level were not verified in the public sources reviewed.** |
| **Netskope Check URL List** — `check_netskope_url_list.py` | Retrieves URL lists and checks for a match within the skill. | **Read:** `GET /policy/urllist` | **Access Control → URL List → View** is the proposed minimum for this retrieval-only operation. Confirm GET coverage in the tenant. The listed operation does not justify permission to modify or apply URL lists. |
| **Netskope Get NPA Policies** — `get_netskope_npa_policies.py` | Retrieves Netskope Private Access rules and, optionally, policy groups. | **Read:** `GET /policy/npa/rules` and/or `/policy/npa/rules/{id}`. Also grant **Read** on `/policy/npa/policygroups` if called. | **Real-time Protection → NPA Policy → View**, with **Policy Group → View** as a documented dependency. Confirm the API associations in the tenant. |
| **Netskope Export Transaction Events** — `export_netskope_transaction_events.py` | Retrieves page or application event records through Datasearch. | **Read:** `GET /events/datasearch/page` and/or `/events/datasearch/application`, according to the types queried. | **Events & Analytics → Page Events → View** and/or **Application Events → View**, matching the selected types. |
| **Netskope Get User Blast Radius** — `get_netskope_user_blast_radius.py` | Queries user-related events to assess potentially affected activity or resources. | **Read** on every concrete `/events/datasearch/{event_type}` path the skill calls. | **View** on each corresponding event function. For example, querying alerts and application events requires access to both. **The complete permission list depends on the skill’s supported event types.** |
| **Netskope Get CCI Score** — `get_netskope_cci_score.py` | Retrieves application Cloud Confidence Index information. | **Read** for the supplied `GET /services/cci/app` operation. Confirm the actual method and filters used by the implementation. | Netskope’s published setup specifies **CCI → Manage**, while the same article also mentions CCI read access. **The minimum permission for this specific GET operation remains unresolved.** See the CCI note below. |
| **Netskope Get Data Export Events** — `get_netskope_dataexport_events.py` | Retrieves records from Netskope Dataexport iterator endpoints. | **Read** on each concrete `/events/dataexport/events/{type}` or `/events/dataexport/alerts/{type}` endpoint used. | **View** on the corresponding event or alert functions. Audit exports map to **Audit Log**; application exports map to **Application Events**. Verify every selected type separately. |
## Additional Information
**✅ Do**
* Use a dedicated service account for AirMDR when your tenant supports RBAC V3.
* Grant only the endpoint and role permissions required by the enabled skills.
* Use the **Tenant URL** and **API Token** from the same Netskope tenant.
* Store the API token in an approved secrets manager and restrict access to authorized administrators.
* Use HTTPS and keep TLS certificate validation enabled.
* If IP allowlisting is enabled, permit the approved outbound IP addresses used by AirMDR or the selected Remote Agent.
* Track token expiration and rotate credentials according to your organization’s security policy.
* During routine rotation, update the token in AirMDR and validate the connection before revoking the previous token.
* Review integration failures, role changes, and access to sensitive DLP forensic information.
* Revoke exposed tokens promptly and replace them in affected connections.
**❌ Don’t**
* Do not share API tokens through email, Slack, or support tickets.
* Do not expose tokens in screenshots, logs, source-control repositories, or configuration examples.
* Do not assign **Tenant Admin** or broad write permissions unless explicitly required and verified.
* Do not assume access to one event endpoint permits access to every event type.
* Do not use an example Tenant URL without replacing it with your actual tenant address.
* Do not send the API token in URL query parameters.
* Do not disable TLS verification to bypass connection errors.
* Do not assume the **Expiry** field in AirMDR extends, rotates, or revokes the token in Netskope.
* Do not retain unused tokens or service accounts after the integration is retired.
* 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
* 🔁 Rotate credentials regularly. Recommended cadence: As per internal security policy
* 🔄 **Reconnect in AirMDR immediately when API Keys are changed.**
Revoke the previous credential after confirming all consumers have migrated.
Legacy tokens retained after RBAC V3 activation continue until expiration but cannot be extended. Plan migration before they expire.
* Use the [Netskope Support portal](https://support.netskope.com/) for tenant access, API availability, or token provisioning issues.
**Data flow**
1. An AirMDR skill initiates a request to the configured Netskope tenant.
2. Netskope evaluates the supplied token and its associated permissions.
3. Netskope returns the requested data or operation result.
4. AirMDR uses the response in the calling workflow.
Depending on the configured skills, exchanged data may include alerts, events, user or device information, and action results. Confirm the actual data categories with the AirMDR Integration team.
| Area | Requirement |
| :-------------- | :------------------------------------------------------------------------------------------------------------------------ |
| Transport | Use HTTPS with certificate validation enabled. |
| Port | Allow outbound TCP `443` from the integration runtime to the tenant hostname. |
| API destination | The configured Tenant URL plus the endpoint used by the skill. |
| Authentication | Send the token in the API header, not in the URL. |
| Storage | Store credentials in approved secret storage. Confirm encryption at rest and retention with the relevant platform owners. |
If Netskope IP restrictions are enabled, allow the actual outbound IP addresses of the integration runtime. Netskope specifically calls out REST API client IP allowlisting.
**Where to check**
| Location | What to review |
| :------------------------------------------------ | :---------------------------------------------------------------------------------------- |
| AirMDR skill or workflow execution details | Failed requests, returned errors, execution duration, and unexpected results. |
| Netskope **Administrators** tab, for RBAC V3 | Service account role and the token status or expiration shown in **API Credential**. |
| Netskope **REST API v2** page, for legacy tenants | Token configuration and expiration. |
| Netskope event views | Relevant records for comparison with API results. Use equivalent time ranges and filters. |
Netskope documents the **API Credential** information on the [Administrators page](https://docs.netskope.com/en/administrators-rbac-v3?utm_source=chatgpt.com).
**Recommended logging**
Where configurable, use **INFO** for routine outcomes, **WARN** for retryable failures, and **ERROR** for failed operations. Enable **DEBUG** temporarily for troubleshooting and redact credentials and sensitive payloads.
Illustrative log entries—not actual AirMDR or Netskope log formats:
```text theme={null}
INFO integration=netskope operation=alert_query http_status=200
WARN integration=netskope http_status=429 action=retry_after_server_delay
ERROR integration=netskope http_status=403 action=review_access
```
Monitor repeated failures, overdue token rotation, and gaps in expected data.
| Error or symptom | Possible cause | Recommended action |
| :------------------------------------ | :----------------------------------------------------------------- | :---------------------------------------------------------------------------------------- |
| `400 Bad Request` | Invalid parameters or request format. | Compare the request with the endpoint’s API documentation. |
| `401 Unauthorized` or `403 Forbidden` | Invalid or expired token, insufficient access, or IP restrictions. | Verify the tenant/token pair, expiry, endpoint permissions, and applicable allowlists. |
| `404 Not Found` | Incorrect URL or unavailable endpoint. | Check the tenant hostname and endpoint path. |
| `409 Conflict` on Dataexport | Concurrent requests use the same endpoint and iterator index. | Serialize requests for that index and assign separate indexes to independent consumers. |
| `429 Too Many Requests` | Rate limit exceeded. | Honor `Retry-After` and rate-limit response headers. |
| `5xx` | Temporary server-side failure. | Retry with backoff; escalate persistent failures. |
| DNS, timeout, or TLS error | Hostname, routing, proxy, firewall, or certificate issue. | Test connectivity from the actual runtime and correct the network or trust configuration. |
| Successful response with no data | No matching records, restrictive filters, or incorrect time range. | Compare against the tenant UI using the same period and criteria. |
| Legacy token creation unavailable | RBAC V3 activated. | Create a service account token using Section 4.2. |