Amazon SP-API: Access to requested resource is denied - amazon-web-services

I have a problem with the connection SP-API through Postman. I am trying to do this via IAM role (which has an inline policy) and I got LWA + wrote all required data right(client_id, refresh_token, client_secret, access_key)
{
"errors": [
{
"message": "Access to requested resource is denied.",
"code": "Unauthorized",
"details": ""
}
]
}

Do you mean for the request:
POST https://api.amazon.com/auth/o2/token
?
For what request are you trying this ?
Cause if its to get the refresh token,
u gotta:
No params
No auth
No added headers
Yes body
Go to body, select "x-www-form-urlencoded"
at the key & values you write (key :: value)
grant_type :: refresh_token
refresh_token :: Atzr|IwE.... (the refresh token u got when u clicked on "Authorize" on your app)
client_id :: amzn1.application-oa2-client.ed752....
client_secret :: a2953b4......
As result you should get:
{
"access_token": "Atza|IwEBIKJpxfB....",
"refresh_token": "Atzr|IwEBIM9QsQUPTJ....",
"token_type": "bearer",
"expires_in": 3600
}
"access_token" is what you need when you do requests
usually by adding it in the headers as "x-amz-access-token"
Also i'm not sure about this cause i forgot but if you have the IAM Role attached to your app, you have to use STS Credentials
If you have the IAM user attached, you can use LWA

Related

How to get value for Client_id and Client_Secret to call API from Postman

I am trying to call RingCentral API from Postman. This is my first attempt and so I am following what is provided by RingCentral documentation: https://developers.ringcentral.com/guide/messaging/sms/postman
I created a Sandbox account and an API app which uses following authorization:
However, when I call from the Postman, I am getting following error:
{
"error": "unauthorized_client",
"errors": [
{
"errorCode": "OAU-251",
"message": "Unauthorized for this grant type"
}
],
"error_description": "Unauthorized for this grant type"
}
Thank you.

Empty response for data studio assets search API

I am trying to fetch the data studio assets to manage the permissions based on that data through APIs.
I am using oAuth2 access token generated using the service account as I want to automate this process and not rely on user consent for authorization every time. oAuth2 authorization using service account
Steps I have followed:
Created service account in Google cloud and enabled Google Workspace Domain-wide Delegation
Delegating domain-wide authority to the service account through Google Workspace account
For the following scopes:
https://www.googleapis.com/auth/datastudio
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
openid
Created and signed JWT
Used JWT token to get the oAuth2 access token to make Datastudio API calls.
Using the following snippet to generate the signed JWT.
import jwt
import time
import json
import requests
iat = int(time.time())
exp = iat + 3600
claim_set = {"iss": "datastudio-manager#data-project.iam.gserviceaccount.com",
"scope": "https://www.googleapis.com/auth/datastudio https://www.googleapis.com/auth/datastudio.readonly https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile openid",
"aud": "https://oauth2.googleapis.com/token", "exp": exp, "iat": iat}
encoded = jwt.encode(claim_set, private_key, algorithm="RS256")
response = requests.post("https://oauth2.googleapis.com/token", params={
"grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
"assertion": encoded
})
print(response.json()["access_token"])
Using token generated from above step to make API call.
curl -H "Authorization: Bearer <access_token>" https://datastudio.googleapis.com/v1/assets:search?assetTypes=report
Response of the above request is {} with status 200 and when I am trying to view permissions for a particular asset it is giving me the following response.
API endpoint: https://datastudio.googleapis.com/v1/assets/<asset_id>/permissions
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
Is authentication using access token generated through the above oAuth2 method supported for Data studio APIs?
Any leads are much appreciated, thanks in advance!

Authorize Cloud SQL Admin API call from Cloud Function

I'm trying to build small function (which later deployed to cloud function) to restore BAK file to cloud sql. This function will be trigerred by cron.
I'm kind of lost when reading the docs about authorize this API: https://cloud.google.com/sql/docs/sqlserver/import-export/importing#importing_data_from_a_bak_file_in
Already create service account which include this role: Cloud SQL Admin, Storage Admin, Storage Object Admin, Storage Object Viewer and choose that Service Account from dropdown when creating Cloud Function but not work.
Also tried generating API keys after reading this: https://cloud.google.com/sql/docs/sqlserver/admin-api/how-tos/authorizing
So my POST url became this:
https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/import?key=generatedAPIKey
but still got an error:
"error": {
"code": 401,
"message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
"errors": [
{
"message": "Login Required.",
"domain": "global",
"reason": "required",
"location": "Authorization",
"locationType": "header"
}
],
"status": "UNAUTHENTICATED"
}
}
Do I need to use Oauth 2 for this? This is my code in Cloud Function:
import http.client
import mimetypes
def restore_bak(request):
conn = http.client.HTTPSConnection("www.googleapis.com")
payload = "{\r\n \"importContext\":\r\n {\r\n \"fileType\": \"BAK\",\r\n \"uri\": \"gs://{bucket_name}/{backup_name}.bak\",\r\n \"database\": \"{database_name}\"\r\n }\r\n}\r\n"
headers = {
'Content-Type': 'application/json'
}
conn.request("POST", "/sql/v1beta4/projects/{project_id}/instances/{instance_name}/import", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
return(data.decode("utf-8"))
This looks like python, so I would recommend using the Discovery Client Library for Python. This library provides a convient wrapper around the SQL Admin API:
# Construct the service object for the interacting with the Cloud SQL Admin API.
service = discovery.build('sqladmin', 'v1beta4', http=http)
req = service.instances().list(project="PROJECT_ID")
resp = req.execute()
print json.dumps(resp, indent=2)
By default, this library uses the "Application Default Credentials (ADC)" strategy to obtain your credentials from the environment.
You can also manually authenticate your requests (for example, if you want to use asyncio) by creating an oauth2 token and setting it as a header in your request. The easiest way to do this is to use the google-auth package to get the ADC and set it as a header:
import google.auth
import google.auth.transport.requests
credentials, project_id = google.auth.default()
credentials.refresh(google.auth.transport.requests.Request())
headers = {
"Authorization": "Bearer {}".format(credentials.token),
"Content-Type": "application/json"
}

How to call Dialogflow Rest API with OAuth access token

I have created project in google console
Enable the Dialogflow API
Created OAuth v2 credential
Using this credentials i called access token api to generate token
https://accounts.google.com/o/oauth2/v2/auth?
scope=https://www.googleapis.com/auth/dialogflow&
access_type=offline&
include_granted_scopes=true&
response_type=code&
state=state_parameter_passthrough_value&
redirect_uri=http://localhost&
client_id= **i placed client id here**
I received access token and passed it to Dialog flow API
https://dialogflow.googleapis.com/v2/projects/**PROJECT-ID**/agent/sessions/123456:detectIntent
Header
Content-Type : application/json; charset=utf-8
Authorization : Bearer **ACCESS_TOKEN**
Body
{
"query_input": {
"text": {
"text": "I know french",
"language_code": "en-US"
}
}
}
Still i am getting this error
"error":{"code": 401, "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",…}
i am not able to identify where i went wrong
Please help thanks in advance
The code that i was passing in api was the OAuth Code(Thanks John Hanley)
API to generate Access token from OAuth Code
Post : https://oauth2.googleapis.com/token
Content-Type: application/x-www-form-urlencoded
{
"code":"OAuth Code",
"client_id":"Client ID",
"client_secret":"Client Secret",
"redirect_uri":"http://localhost",
"grant_type":"authorization_code"
}
In response you receive this
Response
{
"access_token": "Token",
"expires_in": 3599,
"refresh_token": "Refresh Token",
"scope": "https://www.googleapis.com/auth/dialogflow",
"token_type": "Bearer"
}
Pass this access token in header of google API

Code 403 : “The request is missing a valid API key.” PERMISSION_DENIED Service Account Key Google Cloud speech to text api in python"

I want to implement the Google Cloud speech to text using a service account. What i have try is i have set the environment variable to that json and send the post request to this url 'https://speech.googleapis.com/v1/speech:longrunningrecognize'.
Code:
req = requests.post(url, data={
"audio":{
"content":enc
},
"config":{
"audioChannelCount":2,
"enableSeparateRecognitionPerChannel":True,
"enableWordTimeOffsets":True,
"diarizationConfig":{
"enableSpeakerDiarization": True,
"minSpeakerCount": 1,
"maxSpeakerCount": 2
},
}})
Error:
403
{
"error": {
"code": 403,
"message": "The request is missing a valid API key.",
"status": "PERMISSION_DENIED"
}
}
The error message indicates that you are not authenticating correctly. The way to do this is to pass an authentication token as a Bearer Token header in your request.
The following documentation explains how to generate the required credentials and pass them with the request, this provides an overview of service accounts Service accounts overview
Creating a service account instructions Creating service accounts
Once you have created the service account you generate the credentials which are stored in json format, these are then passed as a Bearer Token