For a deeper look into our World Check One API, look into:

Overview |  Quickstart |  Documentation |  Downloads

question

Upvotes
oleksii.kukharenko avatar image
1 ●1 ●1 ●1

Getting 401 Unauthorized for Post requests using Azure API management tool to access World-Check One API with Pilot account

Hello,

I was looking into testing our access by generating a simple request to the Pilot environment, using a POST request to the “/cases” relative path (api-worldcheck.refinitiv.com/v2/cases ) and was getting a response back with the unauthorized 401 error. I transformed JS code from pre-request script from your postman collection into C# (sending script attached, and request body). Just FYI all Get requests work fine both from postman and azure apim, issue only for Post ones. Post requests also work from postman.

Please let me know if any other info is needed.

Thanks,
Oleksii

world-check-oneerror-401
pre-request-script.txt (1.9 KiB)
request-body.txt (214 B)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

wasin.w avatar image   wasin.w

Hello @oleksii.kukharenko

Thank you for your participation in the forum. Is the reply below satisfactory in resolving your query?


If so please can you click the 'Accept' text next to the appropriate reply? This will guide all community members who have a similar question.

Thanks,


AHS

3 Answers

· Write an Answer
Upvotes
judith.pillado.lseg avatar image
1.1k ●2 ●2 ●3

Hello @oleksii.kukharenko, thank you for reaching out to us! Could you also provide the request and response headers please? You can mask the API keys since that is sensitive information, but we need to verify that there is no issue with the dateTime value on both request and response headers.

Thanks,

Judith

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

oleksii.kukharenko avatar image oleksii.kukharenko

Hello @judith.pillado.lseg .


Please see request/response logs attached. request_response_log.txt

Thanks,
Oleksii

request-response-log.txt (7.2 KiB)
Upvotes
judith.pillado.lseg avatar image
1.1k ●2 ●2 ●3

@oleksii.kukharenko - thank you for providing this! I will investigate further and will get back to you when I have an update. In the meanwhile, here are some things that I would like for you to verify on your end:

  • Make sure that the date header value that you are sending is in sync with the NTP or GMT clock. The difference with the API clock should not be greater than 30 seconds. If it is more than 30 seconds, you will get a 401 error.
  • Check/calculate the content length in the request and omit any extra spaces. Since you received a successful response via Postman, your code's authorization headers and content length should match that of Postman's.
  • The Authorization header should be in the following format: 'Authorization: "Signature keyId="XXX{ {API-KEY}}XXXXXX",algorithm="hmac-sha256",headers="(request-target) host date signature="yqVUfwBr/G7KsDAw6xeNGX6u1hMDiNvp3y9sK5P6BKU="'
    However, I noticed that your authorization header includes content-type and the content-length after the date and before the signature. Have you tried removing content-type and content-length? If not, please do so and let me know the outcome.
  • Kindly look at the attached World-Check One API HMAC Walkthrough July 2022.pdf a teammate wrote for the benefit of our users. I hope it is helpful.

Blessings,
Judith

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

oleksii.kukharenko avatar image oleksii.kukharenko

Hi @judith.pillado.lseg. Thank you for the response!

Just a quick update on the points you listed:

  1. I'm pretty confident in calculating the date header value, as I just reused the same as for Get type requests, which works without any trouble.
  2. Regarding Content-Length it's a point to investigate from my side. Indeed the calculated numbers are different in postman and apim (or any other text editor). Will figure that out.
  3. As I noticed authorization header should include content-type and the content-length specifically for Post requests (for Get ones they are not included). These ones also included in pre-requests script in postman collection you provided. And without them, requests give 401 in postman as well (with them it's 200).
  4. Sorry, seems I don't have access to the file you linked. Is it possible to check if access can be granted to my account?

Thanks,

Oleksii

judith.pillado.lseg avatar image judith.pillado.lseg oleksii.kukharenko

Hello @oleksii.kukharenko, thank you for providing an update to all of the points I made above! Regarding #2 - I will wait for a response on your end and will keep investigating on my end. Regarding #4 - Apologies, I am not sure why you are unable to see the PDF. I am attaching it again: world-check-one-api-hmac-walkthrough-july-2022.pdf I have also emailed it to you in case you are unable to view this attachment.

Best,
Judith

world-check-one-api-hmac-walkthrough-july-2022.pdf (412.6 KiB)
Upvotes
judith.pillado.lseg avatar image
1.1k ●2 ●2 ●3

Hello @oleksii.kukharenko - I hope you are doing well. Were you able to investigate the content-length further (point 2)?
After speaking with my teammates, they provided the following sample code: post request c sharp.txt (I will also email it to you in case you cannot view it/open it.) Please note that you will have to provide your API key on the string apikey, your API secret on the string apisecret, and your group Id on the groupId. My teammates also provided me with get request c sharp.txt in case you need it. Please let me know if you have any further questions.

Blessings,

Judith


post-request-c-sharp.txt (5.8 KiB)
get-request-c-sharp.txt (4.4 KiB)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

oleksii.kukharenko avatar image oleksii.kukharenko
Hi Judith,

Sorry for it taking so long to respond. I investigated the point regarding content length, using the pdf document you shared with me I was able to remove all excess characters from the request body, so it is equal to one from Postman, but still got 401 response. Next I figured out that the azure system that I use for API design adds its own characters (extra escape characters and \r) at the step of initialization "dataToSign" variable, which is an argument to generate hmac. So I suspect this is the root cause of the problem. Tried to use Regex.Replace() method, but with no success so far. As soon I am able to fix this, will let you know if 401 response is resolved.

Really appreciate your support with this issue.

Thanks,

Oleksii

judith.pillado.lseg avatar image judith.pillado.lseg oleksii.kukharenko
Hi @oleksii.kukharenko - ah okay, at least you identified what could very possibly be the reason for the 401 error. Please reach out as soon as you have an update. Thanks!

Judith

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.