Successful login and browse, but receiving 401 on folder create attempt - Unauthorized: Access is de

Jeff Wogan

I'm able to log in and browse a folder, but when I try to create folder in the folder I just browsed, I get a 401-Unauthorized response: Access is denied due to invalid credentials. I tried while logged in as myself with all Access writes checked and applied to "This Item & Sub-Items". I've also tried as user with the same access but granted as a member of a group.

Help would be greatly appreciated.

Here's my browse call that successfully returns a JSON string:

browse(13607898);
function browse(node_id){
    var headers = { OTCSTicket: getCookie('OTCSTICKET') };

    $.support.cors = true;
    $.ajax({
        url: url+'nodes/'+node_id+'/nodes',
        type: "GET",
        crossDomain: true,
        dataType: "json",
        headers: headers,
        success:function(res){
            alert(JSON.stringify(res);
        },
        error:function(res){
            alert(res.statusText);
        }
    });
}

However, this call fails. I've used the example on this page as a guide for forming the input parameters.

createFolder(13607898,'Test Folder')
function createFolder(parent_id,foldername){
    var headers = { OTCSTicket: getCookie('TICKET') };
    var data = { type: 0, parent_id: parent_id, name: foldername };

    $.support.cors = true;
    $.ajax({
        url:content_server+'nodes',
        type: 'POST' ,
        data:data,
        crossDomain: true,
        dataType:"json",
        headers: headers,
        success:function(res){
            alert(JSON.stringify(res));
        },
        error:function(res){
            alert(res.statusText);
        }
    });
}

Using Fiddler, I found that the outgoing header of the browse call is:
GET /livelink/llisapi.dll/api/v1/nodes/13607898/nodes HTTP/1.1
Host: ..com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/javascript, /; q=0.01
Origin: http://
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
OTCSTicket: /cfpg65Ts3V+/y/VwPdvi4KbZc4k7kHQ8jGWF8rQDsBVIUPxQ8ybH7MBK4T6fDXGGiwfJYDxlblwas/8Wv8TVg==
Referer: http:///index.cfm?action=test
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8

The outgoing header of the failing createFolder call is:
POST /livelink/llisapi.dll/api/v1/nodes HTTP/1.1
Host: ..com
Connection: keep-alive
Content-Length: 42
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/javascript, /; q=0.01
Origin: http://
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
OTCSTicket: FkZFuKh7wJ1vtQdG2QxdiqoS/axwYsIqhWY4Lai4vH1snppKPBZ1iLtzcB0srDhknvjHFntgzwxZT8/w2jSqPg==
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http:///index.cfm?action=test
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8

-----------------------------------------------

Update 7/17: I thought I'd found the answer this morning, but alas, no joy. After duplicating a Content Server account in AppWorks , I was able to create one folder. But I can't duplicate the results a second time or with the other account.

I've done some more testing. I've been able to change my password and delete a folder.

So to sum up: I can POST /auth, GET /nodes, PUT /members, DELETE /nodes/{id}, but I can't POST /nodes [401-Unauthorized response: Access is denied due to invalid credentials]

-----------------------------------------------

Update 7/17 a:34 PM: I made a call to /apiinfo and the response has nothing defined for the POST action. Is there something that needs to be enabled in AppWorks?

Jeff Wogan

WOW ok here's the solution. Again the scenario: Logging in with my CS account and/or a second CS account, my app was able to authenticate and browse folders and documents, but not create (POST) a new folder. The message returned was 401-Unauthorized response: Access is denied due to invalid credentials.

We have OTDS and AppWorks installed. But here's the step we missed: we didn't create the users in the OTAG partition. Once we did that, the /nodes command worked.

This seems to be a big hole in the system. Should a user account really be able to authenticate and browse without being "correctly" setup to use the REST API?