Some examples on the Security Update API page are wrong

[mattfoster]

Apologies if this is the wrong place to report this sort of feature request. Please let me know if I should file this elsewhere.

The examples on https://portal.msrc.microsoft.com/en-us/developer don't appear to be correct.

Most of the example reference an access token, for example:

@ECHO OFF

curl -v -X GET "https://api.msrc.microsoft.com/cvrf/{id}?api-version=2016-08-01"
-H "api-key: {subscription key}"
-H "Authorization: {access token}"

But there is no information on how to obtain such a token, and the example requests work without adding the Authorization header. In addition, the accompanying documentation does not mention this token.

[craig-martin]

Thanks for keen eye, Matt! The APIs accept two forms of authentication, API keys and access tokens. The option to use access tokens in the Authorization header is for internal use only today (it only accepts tokens from the Microsoft AAD tenant).

I'll update the help to omit that part of the samples.

[IrootGeek]

Hi @mattfoster ;
I try to get API KEY of https://portal.msrc.microsoft.com/en-us/developer but i have the same problem redirect to home page "https://portal.msrc.microsoft.com/en-us/"
How a bout you, do you get your API Key?
Thanks!

[mattfoster]

Hi, https://portal.msrc.microsoft.com/en-us/develope Looks like it's missing a "r" from the end, that could be your problem.

…

On Wed, 17 May 2017 at 14:41, IrootGeek ***@***.***> wrote: Hi @mattfoster <https://github.com/mattfoster> ; I try to get API KEY of https://portal.msrc.microsoft.com/en-us/develope but i have the same problem redirect to home page " https://portal.msrc.microsoft.com/en-us/" How a bout you, do you get your API Key? Thanks! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAKRBqqckY_0_FVLIdrIsy6z5P34xZ7ks5r6vkFgaJpZM4M8ZCx> .

[IrootGeek]

Hi @mattfoster ,
The problem is in the web page of https://portal.msrc.microsoft.com/en-us/developer
Microsoft Security Update API
The Microsoft Security update API is a RESTful API that allows customer to obtain Microsoft security update information. Sample code is available on the Microsoft Security Updates API Github repository which demonstrates how to query this API for automation and reporting purposes.
Create New Key
but if click in Create New Key the page redirect to login ---> home page "https://portal.msrc.microsoft.com/en-us/"

[mattfoster]

Hi @IrootGeek,

I didn't have any problems getting an API key, I just signed in and it worked when I hit the button. Maybe someone from Microsoft can help you.

[ms-AlexDavis]

The last part of this thread runs along side issue #15.

In regards to the original issue, we do not maintain the portal page. Issues pertaining to that can be posted here: https://social.technet.microsoft.com/Forums/security/en-us/home?forum=securityupdateguide

But yes, you don't have to worry about the Authorization header.

[christianmlong]

Here's an example of a curl command that worked.

curl -v -X GET -o ms_cvrf.xml "https://api.msrc.microsoft.com/cvrf/2017-Sep?api-version=2016-08-01" -H "api-key: ###############"