API call via python or curl returns HTTP 403 for admin user

Zenon Skuza

I'm trying to update the enabled state of a mux via the api with the following command but it's failing with Access Forbidden, even though the user is an admin:
curl -X POST -u user:pass -H "Content-Type: application/json" -d '{"node":[{"uuid":"c0d439f847a8a1b3c90848205ee397af", "enabled":0}]}' "http://192.168.20.45:9981/api/idnode/save"

Hope someone here can assist. I'm also performing the same call using python request.post and HTTPDigestAuth but that too returns a HTTP 403.

Any assistance would be appreciated.

payload = {
'node': [{
'uuid': mux['uuid'],
'enabled': 0
}]
}
response = requests.post(f'{server_url}/api/idnode/save', json=payload, auth=HTTPDigestAuth(username, password))

davep

Zenon Skuza Does your user have the "Web Interface" box ticked in Configuration -> Users -> Access Entries?

Here's a javascript function which uses this API (it only works with basic auth):

 function toggle(event, uuid, enabled) {
    let mode = !enabled;
    let data = encodeURIComponent(`[{"enabled": ${mode}, "uuid": "${uuid}"}]`);
    fetch(`/api/idnode/save?node=${data}`).then(response => {
      if (response.ok) {
        ...
      }
    });
    return;
  }

Untested but I believe a simpler form of your query should work:

curl -u user:pass -d node={"uuid":"c0d439f847a8a1b3c90848205ee397af","enabled":0} "http://192.168.20.45:9981/api/idnode/save"

Zenon Skuza

Yes, web interface is enabled.
I tried the modified curl command but it returned error curl: (3) unmatched close brace/bracket in URL position 10: enabled:0}

I also tried enclosing the -d parameter in double quotes and replacing the double-quotes in the node string with single quotes but it returned a HTTP 400 bad request

DeltaMikeCharlie

There is a curl example in the documentation. Have you tried that?

https://docs.tvheadend.org/documentation/development/json-api/examples

DeltaMikeCharlie

I got the following to work:

curl --data-urlencode node=\{\"uuid\":\"INSERT_UUID_HERE\",\"enabled\":0\} "http://localhost:9981/api/idnode/save"

Zenon Skuza

DeltaMikeCharlie this gives a HTTP 400 Bad Request for me.

DeltaMikeCharlie

Zenon Skuza this gives a HTTP 400 Bad Request for me.

I can force a 400 error if the UUID is invalid. Have you confirmed that the UUID that you are trying to edit is correct?

Zenon Skuza

I got it working with python via the following (using data=payload rather than json=payload and encoding the whole node value as a string):
payload = {'node': f'{{"uuid":"{mux["uuid"]}","enabled":0}}'}
response = requests.post(f'{server_url}/api/idnode/save', data=payload, auth=HTTPDigestAuth(username, password))

Thanks for your help with the curl statement @DeltaMikeCharlie