Authenticating to REST API on Postman

[jimmyn]

Hi All,

I have been trying to access our IBM TM1 cloud instance's REST API.
While I can access it via a web-browser (and authenticate via my IBMId), I always get 401 Unauthorized error when trying to access it on Postman.

Below are sample URLs that I use:
https://<<company>>.planning-analytics.ibmcloud.com/tm1/<<databasenae>>/api/v1/Configuration
https://<<company>>.planning-analytics.ibmcloud.com/tm1/<<databasenae>>/api/v1/Cubes
Note that format is a bit different than what outlined in many forums/documentation, i.e. it does not have "/api" after "/tm1".

I have used non-interactive user credential from the welcome kit and pass the credential via header "Authorization" and use value as outlined in documentation i.e. CAMNamespace + base64(user:password:namespace).

Above setting returns 401 Unauthorized error with WWW-Authenticate header value of "openid".
The body returns a function that redirect to authentication website i.e. "https://idaas.iam.ibm.com/idaas......"

Thank you in advance for any help and guidance.

[ascheevel]

You'll want to use address format: https://<company>.planning-analytics.ibmcloud.com/tm1/api/<database>/api/v1/....

You're only using the non-interactive credentials trying to connect via rest right? For cloud, those will be all that work. Your authorization header should look like this: CAMNamespace dXNlcm5hbWU6cGFzc3dvcmQ6Y2Ft. You can use base64encode to convert your username:password:namespace values to base 64.

[jimmyn]

When I use the format
https://<company>.planning-analytics.ibmcloud.com/tm1/api/<database>/api/v1/....

It returns 404 Not Found error in both Web Browser and Postman.

However, when I remove "/api" after the "/tm1", it works on Web Browser and returns 401 Unauthorized on Postman.
Not sure why it works when I change the URL format.

Yes, the authorization header has been configured correctly.

[ascheevel]

When you add the authorization header in Postman, are you checking the checkbox to the left of it to include it in the GET request? It may be the dumb question of the day, but the first request I did in postman, I forgot to check the box and banged my head against the wall a bit too long.

You may want to consider opening a case with IBM where you can share your exact connection parameters.

[ykud]

You don't need extra /api/v1 at the end of the url, this should work:
https://server_name.planning-analytics.ibmcloud.com/tm1/api/client_name
CAMNamespace is set to LDAP, right?

[jimmyn]

asheevel, yes, the check box next to "Authorization" header.
ykud, yes the CAMNamespace is LDAP, also put character ":" in between username, password and "LDAP".

I tried your suggested format:
https://server_name.planning-analytics.ibmcloud.com/tm1/api/client_name
however, it returns with 404 Not Found error.

Do you think that this is to do with the configuration? or may be the API is not properly enabled?

I am contacting our IBM contact and hoping to get their help too.

[kangkc]

This is what we used for all cloud clients:

https://customer.planning-analytics.ibm ... ame/api/v1

The servername is what you see when you login via PAx, PAW or TM1web.

To test it without authentication, issue the $metadata call:

https://customer.planning-analytics.ibm ... /$metadata

[jimmyn]

kangc, I tried the suggested format and change the Server Name to what we know and still comes up with 404.

Is that possible that the REST API on my cloud server is not enabled yet?

When I use the following format, the attached screenshots pops up, but it does not work beyond that.
https://customer.planning-analytics.ibm ... m/tm1/api/

[kangkc]

My understanding is Rest API on PA Cloud is enabled by default. However, to make it work with authentication you have to request for a non-interactive ID to be created which uses the namespace of LDAP. Only then you can use Rest API with authentication.

The screen you are seeing using "https://customer.planning-analytics.ibm ... m/tm1/api/" is normal as IBM uses proxy to redirect to Rest API port.

I can only think that the servername may be invalid to get a 404, note that it is case sensitive hence it has to be the exact name used for the setup.
Alternatively if the default instance "tm1" is active, you can test it as well.

https://customer.planning-analytics.ibm ... /$metadata

[jimmyn]

kangc

Thanks for your help, using the default instance "tm1" seems to work.

https://<<customer>>.planning-analytics.ibmcloud.com/tm1/api/tm1/api/v1/$metadata --Returns value
https://<<customer>>.planning-analytics.ibmcloud.com/tm1/api/tm1/api/v1/Configuration --Returns the correct server configuration.

However, when I try to query the actual data i.e list of cubes:
https://<<customer>>.planning-analytics.ibmcloud.com/tm1/api/tm1/api/v1/Cubes?$select=Name
it returns nothing, but status is 200 OK.
Note: I get the result of list of Cubes on web browser when using the previous wrong URL.


Is this potentially simply a blank default instance? and the actual instance is somewhere else with the unknown name? Is there anyway I can find the instance name?

[kangkc]

Based on what you have tested, there is nothing wrong with the Rest API with your cloud subscription.
I believe you have two issues
1. wrong instance name
2. Authentication issue due to setup

If you are not the assigend PA Administrator/Modeler, suggest you get the correct instanace name from them.
Also you should read up on IBM documentation relating to non-interactive ID.

https://www.ibm.com/support/knowledgece ... count.html

All the best.

[jimmyn]

Thank you all for your help.

I have now managed to connect to REST-API and get the result.

The address format is correct (https://<<customer>>.planning-analytics.ibmcloud.com/tm1/api/tm1/api/v1)
and the username/password is also correct

The issue was with the permission of the non-interactive user itself.
Someone from organisation grants certain access to the non-interactive user and now the API returns correct value.

Thanks all.

[ascheevel]

Thanks for reporting back with your solution!