Receiving 401 Unauthorized response from any write API calls

Q&A
1

I’ve been able to make calls to the API with any number of GET requests, but when I make a call to the API with any POST/PUT ‘write’ methods I get a 401 Response error.

Steps I take:

  1. GET http://bonitatestserver.com:8080/bonita/loginservice
    *) Login as tech_user/secret (this is the initial ‘technical user’ created on the server, and I can successfully use this login in the WebUI of bonita to create and update users.)
    *) After this call I set my cookie up for additional calls
  2. GET http://bonitatestserver.com:8080/bonita/identity/user?p=0&c10
    *) Success, I received a list of 10 users
  3. GET http://bonitatestserver.com:8080/bonita/API/system/session/unusedid
    *) Success, recived session information for tech_user
  4. GET http://bonitatestserver.com:8080/bonita/API/identity/professionalcontactdata/1
    *) Success, I received data for userid = 1
  5. PUT http://bonitatestserver.com:8080/bonita/API/identity/professionalcontactdata/1
    *) Data sent to API: {“building”:“71”} result: 401 Unauthorized
    *) Data sent to API: {“id”:“1”,“building”:“71”} result: 401 Unauthorized
    ) Server responds with a 401 Unauthorized error with or without the 1 on the end.

I’ve tried many other functions, and all my READONLY calls work fine, but any WRITE methods fail.
I’ve also tried logging in with different user accounts,
such as walter.bates, and have been able to only access specific READONLY functions as I would expect.
I also created an Admin user, that had the same results as my initial tech_user account.

Also when viewing both the catalina log file and the bonita logfile, none of my requests (successes or failures) show up in the logs.

Bonitasoft version: 7.0.0 AND 7.0.3 running in docker. (I tried both of these versions with the same result)

Any suggestions on how to get past the 401 errors would be much appreciated. Thanks.

2

Hi,

Your issue might be related to the specific REST API security configuration setup in your Docker image. If you are using https://hub.docker.com/r/bonitasoft/bonita that definitively the case.

You might want to check the official docker image documentation or go directly to this blog post (part 2) and official documentation to learn more about REST API security configuration.

3

Hi

I finally got through this by looking to the CSRF documentation:
http://documentation.bonitasoft.com/7.4?page=csrf-security
(See the “Is there an impact on REST API calls?” section)

After succesfull login, you have to put a special header in your request:
key: X-Bonita-API-Token
value: the one you got after your login (check the relevant cookie)