Python Requests Call Returns 403 Forbidden Error

Issue Details

I'm making requests.get() and/or requests.post() calls to a web service and getting a 403 forbidden error back.  What am I doing wrong?

Solution

There are a number of reasons you could be getting a 403 forbidden authentication error.  You could have a syntax error in the path of your url parameter or in the credentials stored in your headers parameter, or the permissions in the account exported to the api_key you're using might not enable your current request, etc.  One very simple mistake, though, is to assume that the headers parameter is addressable by parameter position:

import requests
request_url = "https://usauslt-6j04p54/niauth/v1/auth"
api_key = "wSo_Orl4sRY5a0n922pDjsFp6kPlKFhl2kdFFQQ5Gz"
headers = {'X-NI-API-KEY': api_key, 'Content-Type': 'application/json'}
requests_resp = requests.get(request_url, headers, verify=false)

All the methods of the requests object have the same function parameters-- a url parameter in first position, a params parameter in second position, then a dynamic list of parameters you have to address by name, not position:

requests.delete(url, params={key: value}, args)

So the requests.get() call in the code example above is actually passing the headers variable to the params parameter, by using the second parameter position.  Instead, you need to pass the headers parameter by name to the headers parameter, like this:

import requests
request_url = "https://usauslt-6j04p54/niauth/v1/auth"
api_key = "wSo_Orl4sRY5a0n922pDjsFp6kPlKFhl2kdFFQQ5Gz"
headers = {'X-NI-API-KEY': api_key, 'Content-Type': 'application/json'}
requests_resp = requests.get(request_url, headers=headers, verify=false)

Additional Information

If you've accidentally passed the headers variable as the second parameter in one of the requests methods, then you have effectively NOT invoked authentication of any type.  Your authentication credentials landed in the json body of the requests call, instead of the headers parameter of the requests call.  In that case, it is completely expected that you would get a 403 forbidden error.