Magento 2 searchCriteria using REST APIs

Question

I have the following query:

$url = http://kostakfashion.com/rest/V1/products/?searchCriteria[filter_groups][0][filters][0][field]=category_gear&searchCriteria[filter_groups][0][filters][0][value]=10&searchCriteria[filter_groups][0][filters][0][condition_type]=finset;

Without searchCriteria it works well. But if i add searchCriteria , I have an error

string(31) "{"message":"Invalid signature"}"

I use OAuth authentication . How could i fix it any idea ?

Answer 1

Looks like solution is found for me magento rest api V1/products endpoint

Just use this lib https://github.com/springimport/magento2-api-v1 It simplifies everything greatly!

Answer 2

The problem is based on Oauth itself. The query parameters has to be included in the oauth signature.

1. When creating the signature use the url without the query parameters
2. Sort the query parameters by key
3. Add the query parameters to the signature data
4. Append the query parameters to the url

Example:

$url = http://kostakfashion.com/rest/V1/products

$search = [
    'searchCriteria[pageSize]' => 10,
    'searchCriteria[currentPage]' => 3
];

ksort($search);

$data = array_merge([
    'oauth_consumer_key' => ...,
    'oauth_nonce' => md5(uniqid(rand(), true)),
    'oauth_signature_method' => 'HMAC-SHA1',
    'oauth_timestamp' => time(),
    'oauth_token' => ....,
    'oauth_version' => '1.0',
], $search);

$data['oauth_signature'] = $this->sign(
    $method,
    $url,
    $data,
    $consumerSecret,
    $accessTokenSecret
);

//Use this url for request
$url .= '?' . http_build_query($search);

One further pitfall. In Magento 2.3 you have to add an empty ?searchCriteria to the url if all products are requested. In this case no add to signature is required.

Answer 3

Update for 2.4.4

Since 2.4.4 version Magento has removed support of 'HMAC-SHA1' and all auth request should use the 'HMAC-SHA256'.

2.4.3 code:

/**
 * Retrieve array of supported signature methods.
 *
 * @return string[] - Supported HMAC-SHA1 and HMAC-SHA256 signature methods.
 */
public static function getSupportedSignatureMethods()
{
    return [self::SIGNATURE_SHA1, self::SIGNATURE_SHA256];
}

2.4.4 code:

/**
 * Retrieve array of supported signature methods.
 *
 * @return string[]
 */
public static function getSupportedSignatureMethods()
{
    return [self::SIGNATURE_SHA256];
}

Update:

Usually this error means you have a misprint in the request, like unnecessary space symbol somewhere :

rest/V1/carts/search?searchCriteria[filter_groups][0][filters][0] [field]=entity_id&searchCriteria[filter_groups][0][filters][0][value]=135&searchCriteria[filter_groups][0][filters][0][condition_type]=eq

In that example I've got it between the [filter_groups][0][filters][0] and [field]=entity_id& lines. Anyway I recommend you to rewrite your request one more time, letter-by-letter, to make sure everything is written correctly.

Original answer:

This error comes from the Magento\Framework\Oauth\Oauth class and it means that calculated on the magento side signature IS NOT EQUAL to the signature from the authorization request. You can debug it in the method _validateSignature (lines ~ 177-203). Here is the method:

/**
 * Validate signature based on the signature method used.
 *
 * @param array $params
 * @param string $consumerSecret
 * @param string $httpMethod
 * @param string $requestUrl
 * @param string $tokenSecret
 * @return void
 * @throws Exception|OauthInputException
 */
protected function _validateSignature($params, $consumerSecret, $httpMethod, $requestUrl, $tokenSecret = null)
{
    if (!in_array($params['oauth_signature_method'], self::getSupportedSignatureMethods())) {
        throw new OauthInputException(
            new Phrase(
                'Signature method %1 is not supported',
                [$params['oauth_signature_method']]
            )
        );
    }

    $allowedSignParams = $params;
    unset($allowedSignParams['oauth_signature']);

    $calculatedSign = $this->_httpUtility->sign(
        $allowedSignParams,
        $params['oauth_signature_method'],
        $consumerSecret,
        $tokenSecret,
        $httpMethod,
        $requestUrl
    );

    if (!Security::compareStrings($calculatedSign, $params['oauth_signature'])) {
        throw new Exception(new Phrase('Invalid signature'));
    }
}

The $params comes here from the initial request and it stores an info like: tokens, signature, nonce etc.

First you should check your credentials on the another side: if you are using some kind of programs like Postman, may be it stored an old tokens. In this case just add a new info from the integration (tokens) and regenerate nonce.

If this does not help you, use xdebug and compare all params one by one, as it can be a typo in the one parameter.

PS: on the screenshot in left-bottom side you can see: what methods has been called in which order, may be it can help you.