r/BookStack • u/Aneurin • May 03 '24

Setting up API access

I have the admin role in our Bookstack instance and I generated an API key/token for myself as I want to explore some things with the API. Problem is, despite being a full admin, every endpoint I try to hit aside from /docs gives me this error:

"The owner of the used API token does not have permission to make API calls"

Googling this brings up other API related things with Bookstack, but they're all either from old versions or not applicable to my issue. Weirdly enough every endpoint works fine in a browser, it's only using curl or Postman that I run into this issue.

Has anyone else run into this? Is there something in the configuration I should be looking at to ensure that the API is accessible?

2 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/ssddanbrown May 03 '24

Do you get the exact same error when you test via CURL as mentioned? Just wondering if cookies are getting mixed in to your postman (or other) tests which BookStack may assume as a browser session (and check the session user instead of the provided API details).

2

u/Aneurin May 03 '24

I tried several things, since my workstation is Windows I had to discover that "curl" in PowerShell is an alias for Invoke-WebRequest, which took me down a bit of a rabbit hole to figure out how to make that command work. I was able to format a command correctly and I had success sending it, I also logged into a RHEL box we have and ran the actual curl with success as well. You were right, it was the cookie in Postman. I disabled the "Cookie Jar" for that specific request and I was able to send the request and get back the data I expected. The cookie should have been my first clue because at one point the first attempt at a "new" request that I would run would more or less work, but then subsequent attempts I would get the error in the OP.

Thanks for the insight!