When configuring the IBM Security QRadar SOAR plug-in installed on JSA, you might come across a "QRadar token test failed. 401 Client Error: 401 for url: https://<JSA.DOMAIN.COM>/api/siem/offense_closing_reasons" error.

During plug-in configuration, the following error is displayed:

QRadar token test failed. 401 Client Error: 401 for url: https://<JSA.DOMAIN.COM>/api/siem/offense_closing_reasons

Root cause: When the Authorized Service Token used by the plug-in is created with the wrong permissions this error is seen.

Solution:

Create a new Authorized Service token in JSA with Admin permissions for both User Role and Security Profile and configure the SOAR app to use it.