Creating a simple script to pull data via SKY API

Dmitriy Brin

Hello I am a software developer at Boston Healthcare for the Homeless Program.


We have recently switched to Financial Edge, and I have been asked to pull some data from your platform to our internal database.


The SKY API seems like a lovely way to do just that, but I am having a lot of trouble doing OAUTH2 from a script.  Since I don't have a website for this and I am behind a firewall, I don't have any way to capture the token that I need to exchange for the auth token. 


My understanding is that once I receive that token once, I can just keep getting the refresh token every time my script is ran by calling https://oauth2.sky.blackbaud.com/token


Here is what I have so far (my cron job is in PHP):

Please help!


<?php


require_once(__DIR__.'/includes/http.php');


$body = array(

'grant_type' => 'refresh_token', 

'refresh_token' => '<how?>',

'client_id' => '3593d58c-429d-42fc-b36e-49162af67651',

'client_secret' => 'BIG_SECRET_I_AM_NOT_POSTING_ON_A_PUBLIC_FORUM');


$headers = array('Content-Type: application/x-www-form-urlencoded');


$result = blackbaud\\Http::post('https://oauth2.sky.blackbaud.com/token', $body, $headers);;


print_r($result);

Dmitriy Brin

Hi wanted to follow up.  Anyone have any thoughts about the best way to capture the refresh token?

Ben Regier

So you were able to get your authorization code but not your refresh token?  What process did you use to get the authorization code?

Dmitriy Brin

Hi Ben, I am copy-pasting from SKY API Console to get the code for now.

Ben Regier

Have you had a look at the authorization tutorial?  Step 4 in particular.  I'm not an expert, but the http request in your script is different from what is suggested there.  What happens when you run your script as it is?  Do you get any response at all?  If your firewall is blocking the request (or the response), there's not much you can do to get around that in your script.

Dmitriy Brin

I have tried that just to realize that I have no way to get the original authorization code for me to exchange for a token.


Basically I could set up a website to do the full OAUTH2 flow, use it once to get the refresh token, and never use it again after that, but I was looking for a shortcut that would help me avoid all of that throw-away labor.


 

Ben Regier

It seems that the shortcut would be to change your firewall settings so that you can make these calls successfully.


This authorization isn't a one-time thing - even if you preserve your refresh token, your access token will still expire, and will have to be refreshed. That process involves making an http call and processing the response. I don't understand how you are going to do that if you don't have a way of getting the refresh token in the first place.  If your only way of getting the refresh token is to set up a website (I assume this is to get around your firewall?), then you're going to have to use that same method to refresh your access token every time it expires.

Dmitriy Brin

My understanding is that the refresh token lasts for a year and that every time I call https://oauth2.sky.blackbaud.com/token to get a new refresh token, I also get a new access token to exchange (both of these actions I can do with CURL from PHP)

Ben Regier

Refresh tokens can last for a year if you use the preserve_refresh_token option.  But unless I'm mistaken, access tokens still expire after 60 minutes.  So you'll still have to regularly refresh your access token, even if you're using the same refresh token to do it.  Can you share the CURL command you use to get your access token?

Ben Regier

What about something like this?


curl -H "Content-Type: application/x-www-form-urlencoded" -H "client_id: <YourClientIDHere>" -H "client_secret: <YourClientSecretHere>" -d "{\\"grant_type\\":\\"authorization_code\\",\\"code\\":\\"<YourAuthorizationCode>\\",\\"redirect_uri\\":\\"<YourRedirectUri>\\"}" https://oauth2.sky.blackbaud.com/token

Dmitriy Brin

Hi folks, thank you all for your help.

I did end up having to setup the PHP tutorial flow to get the first refresh token after all (required some edits to the includes since I was not running it at document root.)


After I got the first token, refreshing/storing the token worked from PHP.


In case others run into this in the future:


$token_fd = fopen('.token', 'r+');


$token = fgets($token_fd);



$body = array('grant_type' => 'refresh_token', 'refresh_token' => $token,

'client_id' => '***********************',

'client_secret' => '************************');


$headers = array('Content-Type: application/x-www-form-urlencoded');



$result = blackbaud\\Http::post('https://oauth2.sky.blackbaud.com/token', $body, $headers);;


$data_object = json_decode($result);



$refresh_token = $data_object->refresh_token;

$access_token = $data_object->access_token;


if($refresh_token){

        ftruncate($token_fd, 0);

        rewind($token_fd);

        fwrite($token_fd, $refresh_token);

}


 

Brad D'Hondt

Anyone figured out a way to do this without the web server?


I am in the same boat as Dmitriy.  We regularly use the ON API to pull data from the "School" part.  We have set up scheduled tasks that basically log in and pull data to feed other databases, etc. (Internal use).  These would be a "scheduled export" in a local run of a traditional application that is hosted on your own hardware/servers.  This works great in the ON API, but with this SKY API, we don't really have a solution.  The "applications" are not web-facing and are not even web apps, just ones to feed data into other databases, etc.  There are also no other "clients" as we just use these for our own internal databases to link Blackbaud data in and they wouldn't be useful for any other school/organization.


Is there some solution here where we can auth via a webportal or something to get these tokens?  We do this for GAM with Google (https://github.com/jay0lee/GAM/wiki/CreatingClientSecretsFile) where we basically log into a Google web interface, authorize the app and create a token .json file to store the credentials.  If something similar is possible with SKY API, that would be great.


I see the pros of the current method of authentication for people building commercial apps that they are selling to multiple entities so that each entity can authenticate the web-based app to their data, but for people trying to do internal database linking/syncing this authentication method doesn't work well.


Thanks,

Brad

Steven Cinquegrana

Brad‍ you can use one of our SKYLib.NET demo (desktop) applications to get your tokens to kick of your own application if you have Visual Studio (which is pretty much free now anyway).


Just plug in your application and subscription details and away you go. (SKYLib.NET is free in rate-limited mode.)




SKYLib itself handles all of the oAuth2 token management, call retries etc, but if you're just interested in initial authorization, the demo apps will get you there.


Cheers,

Steve Cinquegrana | CEO and Principal Developer | Protégé Solutions

 

Lisa Francolini

Hi Brad - I am embarking on a google connection to SKY and wondering if you had any luck with OAuth2 and the refresh token?

Brad D'Hondt

Hi Lisa,


I actually didn't come up with a good solution to this one given all the complexities around getting the tokens out of it. It seems like the Sky API is really designed for a live site creating a tie in to it vs. an API that you can use for offline systems to pull data. You may have more luck as you are looking for a Google tie in. We have stuck with the ON API (the older one) as it works well in that you just request a token on the web interface within Core (basically a long username/password randomly generated by the system) and then can use that to pull advanced lists, etc. with ease. Doing the same in the Sky API really involves having a server running for it to answer to receive the token, etc. vs. just being able to pull one out of core to use. As I mentioned, this isn't really an issue if your application is also web-based, but we were looking more to grab data from Blackbaud and then work with it for our other systems / manipulate it, etc. not as a live-link between two online systems.


Brad

Brian Gray

Lisa Francolini:

I am embarking on a google connection to SKY and wondering if you had any luck with OAuth2 and the refresh token?

Lisa - I use the SKY API and the Google API in several programs that run either on-demand or as a scheduled task. They are written in VB.net using the SKYLib.net library mentioned earlier in this thread. If the program is written in VB (or any other of the Visual Studio languages) and SKYLib, you will get an executable program that does not require a web server to help you negotiate the authentication process.


What part of the Google API are you trying to work with?

Lisa Francolini

Hi Brian,


Thanks for getting back to me. I am trying to work with Google Data Studio and create a google data connection. As a reporting tool, Gstudio gives our administration a nice way to 'run the what if' or 'slice and dice the data'. I have created a number of dashboards in PowerBI using advanced lists....but I heard, perhaps a rumour that it may be deprecated...by chance do you know if that is true? We don't have a developer inhouse and I am an 'old' sql dba - so I may be able to piece together a .net or SSIS solution. I will look at the SKYLib, thanks. We are just starting our discovery in this - so am sure lots of learning in the days ahead. Happy to receive any thoughts on best steps - or 'gottchas'. Take care, hope all is well. Lisa

Brian Gray

I don't use Power BI, so I don't know anything about it's possible future.


SKYLib comes with a nice demo program that shows you how to use the library - and in particular how to complete the authentication process.


I don't use Google Data Studio either, so I don't know what you can do with it's APIs once you have the data from Blackbaud. Many of my programs write CSV files for subsequent use by another program or for automated uploading to a service's site.