3

I try to get one particular customer orders that time i am facing below error.

{
"message": "Consumer is not authorized to access %resources",
"parameters": {
    "resources": "Magento_Catalog::products"
}}

enter image description here

Any one please help me. how i fix this error.

  • Did you passed the authentication for the consumer? – Abhishek Tripathi Dec 7 '17 at 10:21
2

Are you sure that your token is valid? I just checked it using postman too and was able to get list of products. Is your token for an admin or customer? Please, double check that. Customer do not have an access to these resources.

You can read in documentation that customer/admin tokes have different endpoints http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-token.html

More detailed explanation: The resource you are trying to get is configured as follow:

<route url="/V1/products" method="GET">
    <service class="Magento\Catalog\Api\ProductRepositoryInterface" method="getList"/>
    <resources>
        <resource ref="Magento_Catalog::products" />
    </resources>
</route>`

Firstly: ref="Magento_Catalog::products" means that only users with configured ACL which allow access to this resource are allowed to get it. In magento ONLY admin user can have a configuration of ACL.

Secondly: you are using token authentication. In magento you can obtain token either for a customer and for an admin. Since only admin with properly configured ACL can be authorized for this resource you must authenticate yourself with an admin token.

I can see that you are passing a token in your request so my assumption is that you pass a token for a customer or if this is admin's token then this particular admin user do not have access to this resource due to ACL missconfiguration.

  • This is self customer. – Vinoth Kumar N Dec 7 '17 at 10:25
  • No, it is not. What version of Magento you are using? And if you think that it is a self consumer then why would you pass auth token? In Magento\Catalog\etc\webapi.xml on [line:30] there is a configuration for this endpoint. As you can see there is an resource attached which means that you need to follow one of the authentication path. And it is not self. – Bartosz Herba Dec 7 '17 at 10:29
  • I am using magento 2 – Vinoth Kumar N Dec 7 '17 at 10:30
  • That is great, I am talking about magento, hovewer as you might notice magento2 already has 3 meaningfull versions: 2.0.x, 2.1.x, 2.2.x, still, you need a token for an admin and this particular admin user must have properly set ACl – Bartosz Herba Dec 7 '17 at 10:33
  • Sorry... what? You want me to create new topic with question "Are you sure that you use appropriate token?" Really? – Bartosz Herba Dec 7 '17 at 10:39
0

See this page: https://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html

In short, you need to enable anonymous access. Once you do so, consumers and not only admins will be allowed to fetch products (actually, anyone will be able to). There are some security implications to this so you should consider them first. Quote from page:

"Preventing anonymous access to these APIs could cause third-party integrations to fail. If a third-party integration calls any of these web APIs, it will receive an authentication error instead of the expected response. In this case, you might need to disable this feature.

To disable this feature, log in to the Admin panel and navigate to Stores > Settings > Configuration > Services > Magento Web API > Web API Security. Then select Yes from the Allow Anonymous Guest Access menu."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.