[#517] Access Denied

API General
,
1

Migrated from Redmine #517 | Author: Halldor Gislason
Status: Closed | Priority: High, I’m very impatient | Created: 2020-04-20

Hi,
Iam tryging to call the method getUnitList - just to try a simple call.

First I get the token - that works fine, then I set the header valuse for X-Company-Login and X-User-Token in the reguest (I am using PAW to test this)

I set the body to:

{
“jsonrpc”: “2.0”,
“id”: 1,
“method”: “getCategoriesList”,
“params”: {
“isPublic”: “TRUE”
}
}

But I always get code -32600 - Access denied

2

Redmine Admin wrote:

Are you using Client or User API (differences described here API documentation | SimplyBook.me Online Scheduling ) ?
Please provide your raw HTTP request for investigation

3

Halldor Gislason wrote:

Here it is, login and token hiddedn

POST / HTTP/1.1
X-Company-Login: ???
X-User-Token: ???
Content-Type: text/plain; charset=utf-8
Host: user-api.simplybook.me
Connection: close
User-Agent: Paw/3.1.10 (Macintosh; OS X/10.15.4) GCDHTTPRequest
Content-Length: 108

{
“jsonrpc”: “2.0”,
“id”: 1,
“method”: “getCategoriesList”,
“params”: {
“isPublic”: “TRUE”
}
}

4

Halldor Gislason wrote:

I was using getCategoriesList - not unitList but the same error

5

Redmine Admin wrote:

How did you get X-User-Token and what is X-Company-Login?
We do not support named params, please just pass true as described here API documentation | SimplyBook.me Online Scheduling

6

Halldor Gislason wrote:

I got the token using this(with the appropriate companylogin and apikey)

POST /login HTTP/1.1
Content-Type: text/plain; charset=utf-8
Host: user-api.simplybook.me
Connection: close
User-Agent: Paw/3.1.10 (Macintosh; OS X/10.15.4) GCDHTTPRequest
Content-Length: 190

{
“jsonrpc”: “2.0”,
“id”: 1,
“method”: “getToken”,
“params”: {
“companyLogin”: “mycompany”,
“apiKey”: “myapikey”
}
}

The response(again blanked the token)

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 20 Apr 2020 15:54:35 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 102
Connection: close
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Headers: content-type, x-company-login, x-application-token, x-user-token, x-token, x-requested-with
X-XSS-Protection: 1; mode=block

{“result”:“NEWTOKEN”,“id”:“1”,“jsonrpc”:“2.0”}

7

Redmine Admin wrote:

You are using getToken method which is Client API method but passing X-User-Token header which is User API (it is called X-Token for Client API).
Please deside which API you need and do it accroding to documentation here API documentation | SimplyBook.me Online Scheduling

8

Halldor Gislason wrote:

Thanks - that clarified what was doing wrong.

Thanks again for excellent support.

Halldor