rakhesh sasidharan's mostly techie somewhat purpley blog

A niche error probably, just my luck being stuck with it for a major part of my Friday evening today. 🙂

Qualys CSAM API. You authenticate against it like this:

curl -X POST https://gateway.qg1.apps.qualys.com/auth
-d "username=value1&password=passwordValue&token=true"
-H "Content-Type: application/x-www-form-urlencoded"

curl -X POST https://gateway.qg1.apps.qualys.com/auth

-d "username=value1&password=passwordValue&token=true"

-H "Content-Type: application/x-www-form-urlencoded"

Doesn’t work for me. I get the following error:

{"timestamp":"2025-04-25T18:57:29.491+00:00","path":"/auth","status":500,"error":"Internal Server Error","requestId":"6369c22c-12505762","message":"Index 1 out of bounds for length 1"}

1	{"timestamp":"2025-04-25T18:57:29.491+00:00","path":"/auth","status":500,"error":"Internal Server Error","requestId":"6369c22c-12505762","message":"Index 1 out of bounds for length 1"}

If I use PowerShell that too does not work.

$username = "xxx"
$password = 'xxx'

$authUrl = "https://gatxxx/auth"
$header = @{
    "Content-Type" = "application/x-www-form-urlencoded" 
}

$authBody = "username=${username}" + "&password=$password" + "&token=true"
Invoke-RestMethod -Uri $authUrl -Method "POST" -Headers $header -Body $authBody -UseBasicParsing

$username = "xxx"

$password = 'xxx'

$authUrl = "https://gatxxx/auth"

$header = @{

"Content-Type" = "application/x-www-form-urlencoded"

}

$authBody = "username=${username}" + "&password=$password" + "&token=true"

Invoke-RestMethod -Uri $authUrl -Method "POST" -Headers $header -Body $authBody -UseBasicParsing

Here’s the error:

Invoke-RestMethod:
{
  "timestamp": "2025-04-25T18:51:54.905\u002B00:00",
  "path": "/auth",
  "status": 500,
  "error": "Internal Server Error",
  "requestId": "ff6a14e1-12571490",
  "message": "Index 1 out of bounds for length 1"
}

Invoke-RestMethod:

{

"timestamp": "2025-04-25T18:51:54.905\u002B00:00",

"path": "/auth",

"status": 500,

"error": "Internal Server Error",

"requestId": "ff6a14e1-12571490",

"message": "Index 1 out of bounds for length 1"

}

This variant of PowerShell works though, which is how I was using it so far in my PowerShell code:

$username = "xxx"
$password = 'xxx'

$authUrl = "https://gatxxx/auth"
$header = @{
    "Content-Type" = "application/x-www-form-urlencoded" 
}

$authBodyHash = @{ 
    "username" = $username
    "password" = $password
    "token" = 'true'
}

Invoke-RestMethod -Uri $authUrl -Method "POST" -Headers $header -Body $authBodyHash -UseBasicParsing

$username = "xxx"

$password = 'xxx'

$authUrl = "https://gatxxx/auth"

$header = @{

"Content-Type" = "application/x-www-form-urlencoded"

}

$authBodyHash = @{

"username" = $username

"password" = $password

"token" = 'true'

}

Invoke-RestMethod -Uri $authUrl -Method "POST" -Headers $header -Body $authBodyHash -UseBasicParsing

Today, however, I wanted to get this working against Power Automate, so that’s why I was troubleshooting again. With Power Automate, the HTTP connector would just hang there. No errors.

I figure PowerShell is able to do some conversion internally in the second variant (where I pass the body as a hash table), but what is it doing? It’s not converting to JSON (and I tested that anyways, coz I was out of ideas).

Not having much ideas, I then tried Bruno. It too works fine.

Hopefully Bruno shows me what’s happening behind the scenes. And indeed it does! The Timeline tab.

See how certain characters of the password are being escaped! That was it. Bruno and the second variant of PowerShell were escaping behind the scenes.

Once I copied this escaped version of the password to curl, PowerShell, and Power Automate these too started working fine. 🥳