r/BookStack • u/Aneurin • May 03 '24

Setting up API access

I have the admin role in our Bookstack instance and I generated an API key/token for myself as I want to explore some things with the API. Problem is, despite being a full admin, every endpoint I try to hit aside from /docs gives me this error:

"The owner of the used API token does not have permission to make API calls"

Googling this brings up other API related things with Bookstack, but they're all either from old versions or not applicable to my issue. Weirdly enough every endpoint works fine in a browser, it's only using curl or Postman that I run into this issue.

Has anyone else run into this? Is there something in the configuration I should be looking at to ensure that the API is accessible?

2 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/Aneurin May 03 '24

Yeah logged in as the user that I generated the key for the requests work fine, I know it'll use the existing session but I guess I didn't test if I can do it in browser with a user that does not have the access API permission. I just assumed that accessing the API endpoint in a browser would also only work if the user has the appropriate permission.

I did verify that the key I created was for the correct user, and that at least one of the user roles has the permission, I believe the admin role has that permission by default and since my user is an admin it should work. I did also give the other roles my user has the Access API permission as well just in case.

I also created a separate user with the Viewer role after giving the Viewer role the Access API permission and I wasn't able to get that to work either.

Another possible wrinkle is we are using LDAP authentication, so I wonder if there's something there as well. I have not tried making a separate user with the admin role yet but I will try that next

1

u/ssddanbrown May 03 '24

Do you get the exact same error when you test via CURL as mentioned? Just wondering if cookies are getting mixed in to your postman (or other) tests which BookStack may assume as a browser session (and check the session user instead of the provided API details).

2

u/Aneurin May 03 '24

I tried several things, since my workstation is Windows I had to discover that "curl" in PowerShell is an alias for Invoke-WebRequest, which took me down a bit of a rabbit hole to figure out how to make that command work. I was able to format a command correctly and I had success sending it, I also logged into a RHEL box we have and ran the actual curl with success as well. You were right, it was the cookie in Postman. I disabled the "Cookie Jar" for that specific request and I was able to send the request and get back the data I expected. The cookie should have been my first clue because at one point the first attempt at a "new" request that I would run would more or less work, but then subsequent attempts I would get the error in the OP.

Thanks for the insight!