I am using C # to search for orders from last month (last 30 days). Magento version 2 using REST, I am using the call as follows:


The remote server returned an error: (401) Unauthorized.

If the call is:


The server returns all orders.

It's not an authorization error, I really don't find the right way to build the search criteria. I don't find any documentation that explains how to do it

  • Welcome to Magento StackExchange! could you specify what version of Magento is this question about?
    – diazwatson
    Commented Aug 18, 2017 at 10:25
  • Magento version 2.0.13
    – Luís
    Commented Aug 21, 2017 at 9:14

1 Answer 1


I'm building the code like this:

    public class ApiClient

    public ApiClient(string magentoServer, string consumerKey, string consumerSecret, string accessToken, string accessTokenSeccret)
        MagentoServer = magentoServer;
        ConsumerKey = consumerKey;
        ConsumerSecret = consumerSecret;
        AccessToken = accessToken;
        AccessTokenSecret = accessTokenSeccret;

    #region Request

    public HttpWebRequest CreateAuthorizedRequest(string url, string requestMethod, string filter)
        HttpWebRequest request = null;
        if (filter == null)
            request = (HttpWebRequest)WebRequest.Create(url);
            request = (HttpWebRequest)WebRequest.Create(url + "?" + filter.ToString());

        OAuthBase oAuth = new OAuthBase();
        string nonce = oAuth.GenerateNonce();
        string timeStamp = oAuth.GenerateTimeStamp();
        string parameters;
        string normalizedUrl;
        string signature = oAuth.GenerateSignature(new Uri(url), ConsumerKey, ConsumerSecret,
        AccessToken, AccessTokenSecret, requestMethod, timeStamp, nonce, OAuthBase.SignatureTypes.HMACSHA1,
        out normalizedUrl, out parameters);

        StringBuilder sb = new StringBuilder("OAuth ");
        sb.AppendFormat("oauth_token=\"{0}\",", AccessToken);
        sb.AppendFormat("oauth_version=\"{0}\",", "1.0");
        sb.AppendFormat("oauth_signature_method=\"{0}\",", "HMAC-SHA1");
        sb.AppendFormat("oauth_nonce=\"{0}\",", nonce);
        sb.AppendFormat("oauth_timestamp=\"{0}\",", timeStamp);
        sb.AppendFormat("oauth_consumer_key=\"{0}\",", ConsumerKey);
        sb.AppendFormat("oauth_signature=\"{0}\"", signature);

        request.Headers[HttpRequestHeader.Authorization] = sb.ToString();
        request.Method = requestMethod;

        request.Accept = "application/json";
        request.ContentType = "application/json";
        request.KeepAlive = true;

        return request;

    public string FetchRequest(HttpWebRequest request)
            string responseText = string.Empty;
            HttpWebResponse response = (HttpWebResponse)request.GetResponse();
            if (response.StatusCode == HttpStatusCode.OK)
                using (Stream responseStream = response.GetResponseStream())
                    using (StreamReader responseReader = new StreamReader(responseStream))
                        responseText = responseReader.ReadToEnd();
                        return responseText;

            return responseText;
        catch (WebException ex)
            Console.WriteLine("Error: " + ex.Message);
            return null;

    public static string GetValues(string _call, string method)
        ApiClient client = new ApiClient(MagentoServer, ConsumerKey, ConsumerSecret, AccessToken, AccessTokenSecret);
        string url = url_base + _call;
        string t = null;
        HttpWebRequest myReq = client.CreateAuthorizedRequest(url, method, null);
        t = client.FetchRequest(myReq);
        if (t != null)
            t = t.Replace("\\/", "/");
        return t;

The call it's made like:

        public string url = "http://" + magentoServer;
        public string url_base = "/index.php/rest/V1/";

        string _call = "orders?";
        _call += "searchCriteria[currentPage]=1&";
        _call += "searchCriteria[pageSize]=1";
        string _resp = Magento2Form.GetValues(_call, "GET", null);

This single call only with pageSize and currentPage gives me the answer:

Error: The remote server returned an error: (401) Unauthorized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.