V8 API's Giving me the Forbidden Error 403

I have followed the directions closely and I am getting a 403 API error when calling the API. Even if i try to list eh /api/v8/swagger.json

Not sure what to provide to get help. Have gone through the install several times.

It really helps if you say your version. If it’s 7.11.8, apply this fix

https://github.com/salesagility/SuiteCRM/pull/7762/files

Thanks for your help.

Yes I am on 7.11.8.

I have setup SuiteCRM to use SS(selfsignedL. I have tested and suiteCRM works.

I have followed the instructions on the walkthrough for v8 API Endpoint setup

I have updated the file you provided UpgradeAccess.php. I will Attach. I also reran the repair on .htaccess.

Now I get the NOT Found error when trying to make the call to my api. https://10.x.x.x/suitecrm/api/access_token

I also get the same error when trying to get the swagger @ https://10.x.x.x/suitecrm/api/v8/swagger.json

After checking the php_error logs I found this.

[17-Oct-2019 09:54:43 America/Denver] PHP Notice: Undefined variable: oldcontents in /var/www/html/suitecrm/modules/Administration/UpgradeAccess.php on line 109

if (!$skip) {
$oldcontents .= $line;
}

Hey tcohenonline,

I experience the same issue (https://suitecrm.com/suitecrm/forum/installation-upgrade-help/27850-api-access-token-shows-404-file-not-found)

(How) Were you able to resolve it?

You can get rid of the “oldcontents” error by changing this line: https://github.com/salesagility/SuiteCRM/pull/8091/files

However, it won’t affect or improve anything, that error is not relevant. It will be fixed in the next version.

The one that is quite critical to apply if you’re running 7.11.8 is this one:

https://github.com/salesagility/SuiteCRM/pull/7762/files

And then run a Admin / Repairs / Rebuild .htaccess

Tell me if that fixes anything.

I’m interested too, because pgr’s proposal does not fix the error for me. Please share your solution if you have any. Thanks

Are you using the correct entry point with a capital V?

Hi pgr,

yes I do (7.11.8 btw.). I downloaded the premade Postman json. If I use the long link it works though: Api/index.php/V8.

.htaccess content (generated with the hotfix you mentioned earlier):
[spoiler]

BEGIN SUGARCRM RESTRICTIONS

RedirectMatch 403 ..log$
RedirectMatch 403 /+not_imported_.
.txt
RedirectMatch 403 /+(soap|cache|xtemplate|data|examples|include|log4php|metadata|modules|vendor|custom)/+.*.(php|tpl)
RedirectMatch 403 /+emailmandelivery.php
RedirectMatch 403 /+.git
RedirectMatch 403 /+.cache/
RedirectMatch 403 /+tests
RedirectMatch 403 /+RoboFile.php
RedirectMatch 403 /+composer.json
RedirectMatch 403 /+composer.lock
RedirectMatch 403 /+cache/+diagnostic
RedirectMatch 403 /+files.md5$

Options +SymLinksIfOwnerMatch Options -Indexes RewriteEngine On RewriteBase / RewriteRule ^mautic_api/get_token index.php?entryPoint=MauticGetToken [L,QSA] RewriteRule ^cache/jsLanguage/(.._..).js$ index.php?entryPoint=jslang&modulename=app_strings&lang=$1 [L,QSA] RewriteRule ^cache/jsLanguage/(\w*)/(.._..).js$ index.php?entryPoint=jslang&modulename=$1&lang=$2 [L,QSA] RewriteRule ^cache/jsLanguage/(.._..).js$ index.php?entryPoint=jslang&module=app_strings&lang=$1 [L,QSA] RewriteRule ^cache/jsLanguage/(\w*)/(.._..).js$ index.php?entryPoint=jslang&module=$1&lang=$2 [L,QSA]
# --------- DEPRECATED --------
RewriteRule ^api/(.*)$ - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^api/(.*?)$ lib/API/public/index.php/$1 [L]
# -----------------------------

RewriteRule ^Api/(.*)$ - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^Api/access_token$ Api/index.php/access_token [L]
RewriteRule ^Api/V8/(.*?)$ Api/index.php/V8/$1 [L]
RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} (.+)/$ RewriteRule ^ %1 [R=301,L] # END SUGARCRM RESTRICTIONS [/spoiler]

when I replace


    #RewriteRule ^Api/access_token$ Api/index.php/access_token [L]
    RewriteRule ^Api/access_token$ https://google.com [L]

it redirects me to google so it means mod_rewrite does work. So I figure it must be an .htaccess issue but I dont see it :dry:

I learned just yesterday that we have this one pending…

https://github.com/salesagility/SuiteCRM/pull/7832

with accompanying Docs here:

https://github.com/salesagility/SuiteDocs/pull/339

This is probably what you need…

Can you please go into detail about how to use this fix? I don’t get it yet.
As of now, {{suitecrm.url}}/V8/meta/swagger.json gives me “not found”, too.

Did you apply the changes to the 9 files?

If so, and it doesn’t work, please write a comment saying that on the PR (the one for code, not for Docs) on Github.

I took a closer look and even the original files are very different. It is the hotfix for 7.10 but I use 7.11, should I still do it?

Example: the 7.10 Api/V8/Config/routes.php starts off with

use Api\V8\Controller\LogoutController;
use Api\V8\Factory\ParamsMiddlewareFactory;
use Api\V8\Param;
use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\Middleware\AuthorizationServerMiddleware;
use League\OAuth2\Server\Middleware\ResourceServerMiddleware;
use League\OAuth2\Server\ResourceServer;
use Api\Core\Loader\CustomLoader;

while 7.11 Api/V8/Config/routes.php starts off like this (and this is not the commits we are talking about)
use Api\V8\Controller\LogoutController;
use Api\V8\Factory\ParamsMiddlewareFactory;
use Api\V8\Param\CreateModuleParams;
use Api\V8\Param\CreateRelationshipParams;
use Api\V8\Param\DeleteModuleParams;
use Api\V8\Param\DeleteRelationshipParams;
use Api\V8\Param\GetFieldListParams;
use Api\V8\Param\GetModuleParams;
use Api\V8\Param\GetModulesParams;
use Api\V8\Param\GetRelationshipParams;
use Api\V8\Param\ListViewColumnsParams;
use Api\V8\Param\ListViewSearchParams;
use Api\V8\Param\UpdateModuleParams;
use Api\V8\Param\GetUserPreferencesParams;
use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\Middleware\AuthorizationServerMiddleware;
use League\OAuth2\Server\Middleware\ResourceServerMiddleware;
use League\OAuth2\Server\ResourceServer;
use Api\Core\Loader\CustomLoader;

Yes, you should be ok to apply that to 7.11.

Whatever we put on the hotfix-7.10.x branch gets merged later into hotfix-7.11.x.

You will note that this patch is mostly adding stuff, as long as you put it in the right place you should be ok. Just remember to start by making back ups of the original files.

May also be of help. The .htaccess doesn’t get printed out correctly for you to cut and paste.