API key is invalid or has expired - Trying to sync with Tactical RMM

nm123

Hi,

I have just installed a new ITFlow server, and everything is working correctly, however when I try and use this script:

itflow-org/itflow-api-powershell/blob/main/assets/TRMM-create-update.ps1

With My Tactical RMM server, it gives this error:

Invoke-RestMethod : {"success":"False","message":"Authentication failed. API key is invalid or has expired."}
At C:\ProgramData\TacticalRMM\266303465.ps1:90 char:11
+ $exists = Invoke-RestMethod -Method GET -Uri $uri_read
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

I also get an error in the ITFlow audit log:

2024-05-28 12:32:03--API Failed Incorrect or expired key
Entity ID = 0

Does anyone know what I might be doing wrong?

Thanks for what appears to be a very impressive piece of software.

Nick

EDIT: The above error is what I get when I test it on a client device from in the TRMM Script Manager.

When I apply it to a client, and run it on the computers in that client/site, I get the following error:

Invoke-RestMethod : The remote name could not be resolved: '<API KEY WAS HERE- REMOVED FOR SECURITY>' At C:\ProgramData\TacticalRMM\2468923967.ps1:90 char:11 + $exists = Invoke-RestMethod -Method GET -Uri $uri_read + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc eption + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

My ITFlow server is behind a NGINX Reverse Proxy - I am not sure if that could be relevant.

wrongecho

Hey and welcome!

Invoke-RestMethod : {"success":"False","message":"Authentication failed. API key is invalid or has expired."}

I think this one is fairly clear haha.

What's the expiration date of the key and is it valid for the client you're trying to use it for?

Have you tried testing the key is valid using something like the assets/contacts endpoint? Examples here.

Invoke-RestMethod : The remote name could not be resolved:

This sounds like DNS. What happens if you run a nslookup itflow.example.com from the machine that gives you that error?

nm123

Sorry I forgot to say, I created several new API keys while trying to diagnose it. The current one expires 2024-12-29 and it says it is for all clients.

I will have a look at those examples thanks.

If i try NSLOOKUP from one of the machines that gives the error, it resolves to the public ip of the itflow server. And the server responds to pings.

nm123

If I use that example script, with the same API key, it returns a result which starts with:

success count data

------- ----- ----

True 5 {@{0=1; contact_id=1;

So presumably that means the API code is working fine. So for some reason, ITFlow is rejecting it when coming from the TRMM-create-update script in Tactical.

I tried running the example script both directly in powershell on a computer, and also via Tactical RMM, and it worked both times.

wrongecho

nm123

Hmm, definitely seems like an issue with the script.

It was contributed by a community member to the scripts repo but I can't remember who exactly. It's not something I use myself.

@johnny do you remember who wrote this originally that might be able to assist further?

johnny

any luck on this @nm123

nm123

johnny Hi Johnny, I havent got back to have another look yet, so no.

johnny

I recently updated TRMM create Update Script, try the new one as im currently using it

Make sure you set the script Arguments on the left hand side

Make sure you set your Global Vars with the API Key and URL ex https://itflow.myitcompany.com

And the vars per client to match the client_id of ITFlow

nm123

Thanks Johnny,

I still get this error:

Standard Output

$$
API connection error. Aborting...
$$

Standard Error

$$
Invoke-RestMethod : The remote name could not be resolved: '<API KEY WAS HERE>'
At C:\ProgramData\TacticalRMM\3489514778.ps1:112 char:11

$exists = Invoke-RestMethod -Method GET -Uri $uri_read
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

$$

nm123

Never mind, it looks like i didnt have the arguments in correctly. Looks like its working now, i am just testing things out.

Thank you very much

nm123

I can confirm that it is working now.

In the script, it says, for location and network ID, To find the IDs run this script on one PC. Assign the PC to a location and network in ITFlow. Run this script again and take note of the location and network IDs.

This didnt seem to work for me, for the network ID, but I found that, in ITFlow, if i edit/save the location/network (no changes required) then open the audit log for the client, it gives me the Entity ID, which is what is needed.

I might have a look at this doing this myself later, (not sure if it is within my limited scripting ability) but it would be great if the script could fill out the ITFlow URI field with the meshcentral url, so as to allow 1 click remote control from within ITFlow.