Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this community
I try to get one particular customer orders that time i am facing below error.
{
"message": "Consumer is not authorized to access %resources",
"parameters": {
"resources": "Magento_Catalog::products"
}}
Any one please help me. how i fix this error.
Are you sure that your token is valid? I just checked it using postman too and was able to get list of products. Is your token for an admin or customer? Please, double check that. Customer do not have an access to these resources.
You can read in documentation that customer/admin tokes have different endpoints http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-token.html
More detailed explanation: The resource you are trying to get is configured as follow:
<route url="/V1/products" method="GET">
<service class="Magento\Catalog\Api\ProductRepositoryInterface" method="getList"/>
<resources>
<resource ref="Magento_Catalog::products" />
</resources>
</route>`
Firstly: ref="Magento_Catalog::products" means that only users with configured ACL which allow access to this resource are allowed to get it. In magento ONLY admin user can have a configuration of ACL.
Secondly: you are using token authentication. In magento you can obtain token either for a customer and for an admin. Since only admin with properly configured ACL can be authorized for this resource you must authenticate yourself with an admin token.
I can see that you are passing a token in your request so my assumption is that you pass a token for a customer or if this is admin's token then this particular admin user do not have access to this resource due to ACL missconfiguration.
See this page: https://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html
In short, you need to enable anonymous access. Once you do so, consumers and not only admins will be allowed to fetch products (actually, anyone will be able to). There are some security implications to this so you should consider them first. Quote from page:
"Preventing anonymous access to these APIs could cause third-party integrations to fail. If a third-party integration calls any of these web APIs, it will receive an authentication error instead of the expected response. In this case, you might need to disable this feature.
To disable this feature, log in to the Admin panel and navigate to Stores > Settings > Configuration > Services > Magento Web API > Web API Security. Then select Yes from the Allow Anonymous Guest Access menu."
