Delete authorization??

Jon Luers
Jon Luers
Ninth Anniversary Participant Facilitator 1 Loyalty Badge
in Blackbaud Raiser's Edge NXT® APIs
I'm trying to delete obsolete ratings records and getting Unauthorized responses. I had permissions added to my account(?), so I'm able to delete a rating from the endpoint reference test page, but now I'm getting the error just when I try to issue the Delete Rating request from a C# application. How can I verify which user is implied by the authorization code I'm using? Is the user implied by the account that created the Application ID?

Comments

  • Daniel Leonard
    Daniel Leonard Blackbaud Employee
    Eighth Anniversary Kudos 2 Name Dropper Participant
    Hi Jon,


    During the authorization code flow, after your application is authorized for an environment by a user, your application will be granted a one time use authorization code. That authorization code will then be used to get an access token. The access token will be used to determine user access while making SKY API requests and is valid for 60 minutes. A refresh token will be given at the same time as the access token. The refresh token is used to get another access token, without needing to get another authorization code, and is valid for 1 year. Authorization codes, access tokens, and refresh tokens are all sensitive values that allow access to data and should be handled carefully to avoid compromise.


    The access token used in requests being made to SKY API would have the same access as the user that creates the authorization code and consented to the application accessing the data in that environment. One way to see the id of the user that consented is in the response of the access token request.
    https://developer.blackbaud.com/skyapi/docs/authorization/auth-code-flow/tutorial#tokens-returned





  • Jon Luers
    Jon Luers
    Ninth Anniversary Participant Facilitator 1 Loyalty Badge
    Thanks, but this doesn't answer my question. I have successfully retrieved authorization codes and access and refesh tokens and used GET Ratings and Consitituents, etc., and POST Ratings, but when I tried DELETE Rating I got a response saying "Unauthorized" and something to the effect of "This user does not have permission for this request." An NXT administrator gave my account Delete permission, and then I was able to issue successful DELETE Rating requests from the Endpoint Reference Test page, but when I use an access token that I have authorized to DELETE Rating from a C# application, I'm still getting the 401 "Unauthorized" response. How can I determine the specific problem and solution?
  • Jon Luers
    Jon Luers
    Ninth Anniversary Participant Facilitator 1 Loyalty Badge
    I figured it out. I was adding "bb-api-subscription-key" and "Authorization" headers before each DELETE request, so on the second and subsequent requests the redundant headers triggered an "Unauthorized" response.

Categories