JSON API + Remote Provisioning (XML)

[Mike521w]

We've been using the JSON API successfully for a few months now for various tasks (get item data, update item data, etc). We also have the Remote Provisioning (XML) tool available on our site for a project from a couple of years ago.

The other day I started a new project where I want to use the JSON API + Remote Provisioning to add an attribute template to an item. We're using the HMAC signature + timestamp, so I think we're good as far as permissions go. Also the JSON API token we're using is correctly assigned to a group, and that group has been granted full privileges. However, when I make the call I get an Access Denied error, with no further info available.

The JSON call I'm making is along these lines:

{
"Store_Code": "ZZZZ",
"Function": "Provision_Store",
"xml" : "<ProductAttribute_Add_Template product_code='asdf'><AttributeTemplateCode>asdf</AttributeTemplateCode></ProductAttribute_Add_Template>"
}

The access denied message is:

{
"success": 0,
"error_code": "access_denied",
"error_message": "Access denied"
}

Last thing, if I deliberately screw up the function name in the JSON call:

"Function": "Provision_Store_asfasdfasdf"

the error changes (as expected) to:

{
"success":      0,
"error_code":   "invalid_function",
"error_message":        "Invalid function"
}

Anyone encounter a similar issue and see what I might be doing wrong here?

[Brennan]

Have you tried running other functions using that API token?

The reasons you would get access denied are:

1. Invalid Access Token
2. Missing Header Type or Type mismatch
3. Invalid Content Type
4. IP address is not whitelisted
5. Access Token does not have sufficient privileges

[Mike521w]

Hi Brennan,

yes, actually the script first uses the same API token for some other tasks, and those all work fine. Then when it gets to the step of adding the attribute template to the item, it gets the access denied error. So I think that demonstrates that issues 1 - 5 that you listed aren't the cause here. It *seems* like the access denied error is coming from the Remote Provisioning tool.

I thought maybe the RP tool wanted the JSON API to pass the RP tool's token in the header? Or maybe the JSON API sends its request from a different IP address that isn't whitelisted by the RP tool? I logged in via SSH and ran `hostname -I` and added all the addresses to both the JSON API token's whitelist and the RP tool's whitelist, but the RP tool's whitelist is per access token, and maybe I missed it but I don't see a way to tell the JSON API to pass an RP access token through.

[Brennan]

You also need to make sure you function is whitelisted with the API token

Under Functions, make sure provision_store is added to the API token

provision_store.jpg

[Mike521w]

That was it, thanks Brennan!

[kayakbabe]

what about when you get authorization required.


This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.


*DUH* my site is behind a simple htaccess password protection ... so of course it won't work. (leaving my comment here because someone else is surely going to run into this too and not think about it)