[SOLVED] Powershell: Catching WebRequest Respose differs from Native Response

Powershell: Catching WebRequest Respose differs from Native Response

I'm having a little issue with getting the same data from the exception inside a catch block from what I would get without.

A call to Microsoft Defenders ATP API without a try/catch block renders the following error message:

Invoke-WebRequest : {"error":{"code":"ActiveRequestAlreadyExists","message":"Action is already in progress","target":"{security string redaction}"}}
At line:35 char:27
+ ... ardAction = Invoke-WebRequest -Uri $Offboarduri -Headers $Headers -Me ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

However, When in a catch block it is not possible to capture any of the additional information in that message that would be useful (specifically the {code":"ActiveRequestAlreadyExists","message":"Action is already in progress"} parts)

I've put the following in my catch to try to interigate the feedback but nothing correlates to that data:

Write-Host "Exception Defaults"
$_.Exception | Select *
Write-Host "Exception Response Sub Text"
$_.Exception.Response | Select *

These give me very generic responses:

Exception Defaults
Status         : ProtocolError
Response       : System.Net.HttpWebResponse
Message        : The remote server returned an error: (400) Bad Request.
Data           : {}
InnerException : 
TargetSite     : System.Net.WebResponse GetResponse(System.Net.WebRequest)
StackTrace     :    at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.GetResponse(WebRequest request)
                    at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.ProcessRecord()
HelpLink       : 
Source         : Microsoft.PowerShell.Commands.Utility
HResult        : -2146233079

Exception Response Sub Text
IsMutuallyAuthenticated : False
Cookies                 : {}
Headers                 : {x-content-type-options, x-request-id, OData-Version, Strict-Transport-Security...}
SupportsHeaders         : True
ContentLength           : 137
ContentEncoding         : 
ContentType             : application/json; odata.metadata=minimal
CharacterSet            : 
Server                  : Microsoft-HTTPAPI/2.0
LastModified            : 04/03/2021 18:31:13
StatusCode              : BadRequest
StatusDescription       : Bad Request
ProtocolVersion         : 1.1
ResponseUri             : https://api.securitycenter.windows.com/api/machines/{security string redaction}/offboard
Method                  : POST
IsFromCache             : False

Does anyone know of a way in which we can capture the original text to make feedback from an error more constructive than just "Bad Request" so that it would be more apparent that the request was bad due to a request preceeding it already in progress.

Thanks

Solution

To read the response (which may have already been read):

# obtain stream
$stream = $_.Exception.Response.GetResponseStream()

try {
  # rewind stream cursor
  [void]$stream.Seek(0, 'Begin')

  # read entire response body
  $reader = [System.IO.StreamReader]::new($stream)
  $body = $reader.ReadToEnd()

  # return or parse/inspect $body here ...

}
finally {
  # clean up
  if($reader -is [System.IO.StreamReader]){
    $reader.Dispose()
  }
  $stream.Dispose()
}