Box API: Create folder on behalf of another user - python-requests

I am able to create folder via put API call.
Now I am trying to use User impersonation to create a new folder giving following headers.
headers = { "Authorization" : "<token>", "As-User" : "237490238" }
It is always giving me 403 forbidden as response.
I also tried creating folder this way via POSTMAN giving X-On-Behalf-Of and X-As-User headers. The response is 201 ( created ) but created_by is not the user (with id = '237490238') provided in headers.
Is it possible to have user impersonation in creating files/folders , creating shared links for files/folders via API?

1: Your Authorization header is not formatted properly. The value needs to be prefixed by Bearer:
headers = {
"Authorization" : "Bearer <token>",
"As-User" : "237490238"
}
2: Ensure that the scope of your authorization token includes Manage an enterprise. This is required in order to use the As-User functionality.

Related

workfront : blank response on attempt to create API key

When I attempt to derive an APIkey from a user account in Workfront using the methods detailed in https://developers.workfront.com/api-docs/#API_key I only get a blank response. Whilst most users in this domain auth using SAML the user in question has been set up as a API account and SAML is disabled.
The URL used is:
/attask/api-internal/user?action=getApiKey&username=yyyyy#xxxxx&password=xxxxxxxx&method=put (xxx and yyy masking actual text)
... and I receive the following result. I get the same result in both prod and sandbox
{
data: {
result: ""
}
}
If I use an invalid user/password pair I receive the following result:
{
error: {
class: "com.attask.common.AuthenticationException",
message: "That username/password combination wasn't quite right.
Make sure your caps lock isn't on and try again."
}
}
If use the user/password method to auth (https://developers.workfront.com/api-docs/#Authentication) this works and I receive the full session information.
If you are getting a blank response then you do not have a API key to get. You can either generate on in the UI by opening setup > system > customer info or through the API
/attask/api/v5.0/user?action=generateApiKey&username=yyyyy#xxxxx&password=xxxxxxxx&method=put

Paw Extensions : Dynamic Value based on URI

I have an API that includes an account ID as part of the url (e.g. /account/7319310/report) where 7319310 is then account ID.
There are different credentials for each account, stored in MySQL although they could be stored in another manner if it made it easier.
I'd like Paw to automatically use the correct credentials based on the account parameter in the URI (it's always the second element) - is this possible?
In paw you can use a regex Dynamic to extract the data you need from the url:
Paw does not have a direct connection to MySQL, you can make http request from a custom value but you would need a server running to push these request to the server. A better option would be to save the credentials into a flat json file.
{
"1234334": {
"key1": 123456,
"key2": 345211
}
}
With this saved you can load this json file in a Custom Dynamic Value:
Here you can embed the extracted user id by using the regex dynamic value. inline in the code. Paw will reload the file on every request so you could set up a cron job to dump your database to this JSON file.

External login with AspNet Web API

im trying to do external login with Google using Aspnet.
I created an mvc/webapi project with individual user accounts (vs2013). This will create some files like the 'AccountController' which contains GetExternalLogins action, after calling this action I get (because the google external login is set in the 'Startup' class) an object like this :
{
name: "Google",
state: null,
url: "/api/Account/ExternalLogin?provider=Google&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A11166%2F"
}
The problem now : when i do another http request to "/api/Account/ExternalLogin?provider=Google&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A11166%2F" I get the following error :
XMLHttpRequest cannot load https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=my_client_id_here. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:11166' is therefore not allowed access
Im i doing something wrong ?
Thanks a lot.
I realized that its a silly question 5 seconds after posting it.
No need to do an http request, a simple redirection to the url works.

Alfresco cloud modify file https method

I use alfresco cloud.
I can authentificate, get my access_token, and access to a file by having a get request:
[GET] https://api.alfresco.com/mycompany.com/public/cmis/versions/1.0/atom/content?id=id_of_my_file&access_token=my_access_token
Now I want to update the content of the file. The doc say to use PUT request. Is what I did :
[PUT] https://api.alfresco.com/mycompany.com/public/cmis/versions/1.0/atom/content?id=id_of_my_file&access_token=my_access_token
But I have this error :
{
"error":"invalid_request",
"error_description":"Missing access token"
}
As Gagravarr says, try putting your access token in the authorization field of the HTTP request header, like this:
Bearer [your access token]
See "Using the Access Token" in the API documentation PDF.

URLRequestDefaults.setLoginCredentialsForHost not setting the user & pwd in authorization header

I want to access html files which are protected by basic authentication.
I am trying to load this html page using htmlloader and sending the request by urlRequest.
I am using URLRequestDefaults class to set the credentials but when I see the request being send in the fiddler I don't see any authorization header being set by this.
Am I doing something wrong here. My code is below.
URLRequestDefaults.authenticate = false;
URLRequestDefaults.setLoginCredentialsForHost("www.xyz.com", "madhur", "sharma");
var req:URLRequest = new URLRequest("http://bazinga.xyz.com/MyHtml/index.html");
htmlControl.htmlLoader.load(urlRequest);
You should read the API more carefully:
Note that "example.com", "www.example.com", and "sales.example.com" are each considered unique hosts.
In this case, the domains don't match.

Resources