> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-absolute-api.md).

# Pull data from the Absolute API

## Overview

Use the **HTTP Pull** Listener to collect data from the [Absolute API](https://abnormalsecurity.my.site.com/knowledgebase/s/article/Abnormal-REST-API-Integration). Currently, we support the device reporting endpoint.

## HTTP Pull Listener configuration

In Falcon Onum, go to the **Listeners** area and click **New Listener > HTTP Pull**. Give a name to your new Listener and enter the following data:

### Parameters

N/A

### Secrets

You must define these credentials in Onum:

* `secretKey` will reference your Absolute secret key.
* `TokenId` will reference your Absolute token ID.

To do it, click **Add element** and enter a **Name** for the secret (in this case, `secretKey`). Then, click the **Value** field and select **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

You can now select the secret you just created in the **Value** field list. Repeat the process for the `TokenId`.

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/settings/organization-settings/secrets-management.md).
{% endhint %}

### Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle **ON** the **Config as YAML** option to enable a free text field where you can paste the following YAML:

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: hmac
  hmac:
    request:
      generateId: false
      idType: uuid
      generateTimestamp: true
      timestamp:
        tz: UTC
        format: RFC1123
    hash:
      algorithm: hmac_sha256
      encoding: base64
      secretKey: ${secrets.secretKey}
      dataToSign: "${request.method}\n${request.relativeUrl}\n${request.timestamp}\n${request.body}\n"
    headers:
      - name: x-abs-date
        value: ${request.timestamp}
      - name: Authorization
        value: "Absolute token=${secrets.TokenId}:${hmac.hash}"
withEnumerationPhase: false
collectionPhase:
  paginationType: "responseBodyLink"
  responseBodyLinkSelector: ".metadata.pagination.nextPage"
  request:
    responseType: json
    method: "GET"
    url: "https://api.absolute.com/v3/reporting/devices"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
    queryParams: 
      - name: nextPage
        value: "${pagination.responseBodyLink}"
      - name: pageSize
        value: "500"
      - name: timeZone
        value: "UTC"
      - name: lastUpdatedDateTimeUtcFromInclusive
        value: ${temporalWindow.from}
      - name: lastUpdatedDateTimeUtcTo
        value: ${temporalWindow.to}
  output:
    select: ".data"
    map: "."
    outputMode: "element"
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

* **Duration**<mark style="color:$primary;">**\***</mark> - `5m`
* **Offset**<mark style="color:$primary;">**\***</mark> - `5m`
* **Format**<mark style="color:$primary;">**\***</mark> - `RFC3339`

**Authentication**

Toggle **ON** to configure the authentication phase.&#x20;

* **Type**<mark style="color:red;">**\***</mark> - `HMAC`
* **HMAC**
  * **Request**
    * **Generate Timestamp** - Toggle **ON**
    * **Timestamp**
      * **Format** - `RFC1123`
  * **Hash**
    * **Hashing algorithm**<mark style="color:$primary;">**\***</mark> - SHA256&#x20;
    * **Format**<mark style="color:$primary;">**\***</mark> - `base64`&#x20;
    * **Secret key** - `${secrets.secretKey}`&#x20;
    * **Data to sign**<mark style="color:$primary;">**\***</mark> - `${request.method}\n${request.relativeUrl}\n${request.timestamp}\n${request.body}\n${request.method}\n${request.relativeUrl}\n${request.timestamp}\n${request.body}\n`&#x20;
  * **Headers**
    * **Name** - `x-abs-date`
    * **Value** - `${request.timestamp}`
    * **Name** - `authorization`
    * **Value** - `Absolute token=${secrets.TokenId}:${hmac.hash}`

**Collection Phase**&#x20;

* **Pagination Type**<mark style="color:red;">**\***</mark> - `Next Link at Response Body`
* **Selector**<mark style="color:red;">**\***</mark> - `.metadata.pagination.nextPage`
* **Request**&#x20;
  * **Response type**<mark style="color:$primary;">**\***</mark> - `JSON`
  * **Method**<mark style="color:red;">**\***</mark> - `GET`
  * **URL**<mark style="color:red;">**\***</mark> - `https://api.absolute.com/v3/reporting/devices`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Content-Type`
    * **Value** - `application/json`
  * **Query params**
    * **Name** - `nextPage`
    * **Value** - `${pagination.responseBodyLink}`
    * **Name** - `pageSize`
    * **Value** - `500`
    * **Name** - `TimeZone`
    * **Value** - `yourtimezone`
    * **Name** - `lastUpdatedDateTimeUtcFromInclusive`
    * **Value** - `${temporalWindow.from}`
    * **Name** - `lastUpdatedDateTimeUtcTo`
    * **Value** - `${temporalWindow.to}`
* **Output**&#x20;
  * **Select**<mark style="color:$primary;">**\***</mark> - `.data`
  * **Map** - `.`
  * **Output Mode**<mark style="color:$primary;">**\***</mark> - `element`
    {% endtab %}
    {% endtabs %}

When you're done, click **Create labels** to move on to the next step and define the required [Labels](/listeners/labels.md) if needed.