# Call External REST API from Kibana Plugin

**URL:** <https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541>\
**Category:** Kibana\
**Created:** [December 6, 2017, 4:27pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541 "2017-12-06T16:27:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tamisalex](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tamisalex](https://discuss.elastic.co/u/tamisalex)\
**Post date:** [December 6, 2017, 4:27pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541/1 "2017-12-06T16:27:26Z")

</div>

My question is very similar to this thread: [How to call external web service from Kibana Plugin?](https://discuss.elastic.co/t/how-to-call-external-web-service-from-kibana-plugin/50184)

However, I don't have control over this api so I cant change what headers/origin it accepts. The external REST api accepts all origins. However, the cors preflight check when I try an ajax call fails because kbn-version is in access-control-request-header.

Actual Error:  
request header field kbn-version is not allowed by Access-Control-Allow-Headers in preflight response.

Is there a way I can remove this header when I make an ajax call from my plugin's controller.js

Thanks,

Alex

---

<div class="post-metadata">

**Author:** ![tamisalex](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tamisalex](https://discuss.elastic.co/u/tamisalex)\
**Post date:** [December 6, 2017, 4:34pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541/2 "2017-12-06T16:34:34Z")

</div>

API Call

> $.ajax({  
> url: '[https://en.wikipedia.org/api/rest\_v1/page/summary/Supercapacitor?redirect=true](https://en.wikipedia.org/api/rest_v1/page/summary/Supercapacitor?redirect=true)'  
> }).then(function (data) {  
> $scope.title = data.title;  
> $scope.summary = data.extract\_html;  
> $element.trigger('renderComplete');  
> });

Request Headers

> :authority:en.wikipedia.org  
> :method:OPTIONS  
> :path:/api/rest\_v1/page/summary/Supercapacitor?redirect=true  
> :scheme:https  
> accept:_/_  
> accept-encoding:gzip, deflate, br  
> accept-language:en-US,en;q=0.9  
> access-control-request-headers:kbn-version  
> access-control-request-method:GET  
> origin:[http://10.108.21.121:5601](http://10.108.21.121:5601)  
> user-agent:Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/62.0.3202.94 Chrome/62.0.3202.94 Safari/537.36

---

<div class="post-metadata">

**Author:** ![tamisalex](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tamisalex](https://discuss.elastic.co/u/tamisalex)\
**Post date:** [December 6, 2017, 4:35pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541/3 "2017-12-06T16:35:57Z")

</div>

I accidently placed this in the X-Pack section, please let me know if I should report in Kibana section.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [December 6, 2017, 8:30pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541/4 "2017-12-06T20:30:42Z")

</div>

Adding a `kbnXsrfToken` flag to the options of the HTTP call should do the trick.

If you were to use the Angular `$http` service (for no reason other than I personally see it more often), it would look like:

```auto
uiModule.controller('myView', ($injector, $scope) => {
  const $http = $injector.get('$http');
  const options = {
    method: 'GET',
    url: 'https://en.wikipedia.org/api/rest_v1/page/summary/Supercapacitor?redirect=true',
    kbnXsrfToken: false,
  };

  $http(options).then(result => {
    $scope.resultData = result.data;
  });
});

```

---

<div class="post-metadata">

**Author:** ![tamisalex](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tamisalex](https://discuss.elastic.co/u/tamisalex)\
**Post date:** [December 7, 2017, 5:08pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541/5 "2017-12-07T17:08:33Z")

</div>

Thanks @tsullivan! It worked brilliantly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2018, 5:08pm UTC](https://discuss.elastic.co/t/call-external-rest-api-from-kibana-plugin/110541/6 "2018-01-04T17:08:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.