Error 403 - Access Denied- during some commands

[RoderikdW]

I am quite new to RestFul API and have been experimenting with it somewhat.
I have managed to log in and create a session

I have included my X-RestSvcId into all requests after logging in, but I keep getting the 203 -Access Denied Error
Occasions on which this has happened:
Trying to GET jobs (/api/jobs)
Trying to POST creation of a cloud tenant (api/cloud/tenants)

Strangely though this error did not occur during 'GET' backupservers (/api/backupservers)

anyone who can assist me in this issue?

Kind Regards

[Shestakov]

Hello, RoderikdW.
Please provide your support case ID number, if you want to keep this thread open, as it is requested if post about errors/technical issues (right when you click New Topic).
Thanks.

[RoderikdW]

ah right! that would be: 00442053

[Shestakov]

I guess you mixed up the support case number. The one you provided was opened in 2013 about some Veeam One issue.
Have you contacted technical support recently? If no please do, if yes, please provide actual support case number. Thanks!

[RoderikdW]

ah sorry I thoughti t was the support ID
I opened a case and this is it's case ID: 00907361

[RoderikdW]

it was error 403 by the way, not 203!

[veremin]

Be aware to follow the logon procedure specified here, and also use the account with sufficient privileges. Thanks.

[RoderikdW]

I am logging in correctly and logging in as Portal Administrator, so I should have sufficient permissions!

[veremin]

Those were first things to check, more like usual suspects. For more detailed investigation the code, as well, as log review is required. Keep working with the support team and, kindly, update the topic with a solution, when it's found. Thanks.

[RoderikdW]

The account which I use the Restful api with is an account with a Cloud Provider License. Although this is just a guess, is it possible that this is related to the license itself?

[veremin]

Cloud Connect APIs are open in every edition, if I remember that correctly. You seem to get access denied issue while to querying those. So, my answer would be no, it must be something different. Thanks.

[RoderikdW]

Okay, thanks!
I will wait for a reply from support in that case and update when I obtain any new knowledge concerning this issue.

[veremin]

Sounds like the best idea, indeed. Kindly, keep us updated.

[RoderikdW]

It seems that it is indeed the license used, that causes the Access Denied Error.
I was under the impression that Cloud Provider licenses were different from other licenses, but this is not the case.
Cloud Provider is an additional feature to the license, which is available in Standard, Enterprise & Enterprise Plus regardless of whether you are Cloud Provider or not.
However the license used on our B&R Cloud Connect Server is a rental license with a monthly fee of 4.50 euro for every VM in our repositories.
Currently I am not quite sure how changing to Enterprise will affect our rental license, as it will be customers sending their backup jobs to our repositories from their own B&R server.
The question I asked in this topic however has been answered. The license used by the B&R Cloud Connect Server is not sufficient to provide me with full RestFul API access.

Kind Regards,
Roderik

[veremin]

It should be sufficient to work with Cloud Entities, such as Cloud Gateways, Cloud Tenants, etc. via RESTful API. That's been the intended behavior. Are saying that it's not the case? Thanks.

[RoderikdW]

According to a short call I had with one of your collegues, I was informed that in the Standard Cloud Provider Rental License that it is not possible to configure Cloud Tenants and several other functions. However I was informed that it is the case that the rental license is automatically delivered as standard rental license until an Enterprise Plus Rental License is requested. After requesting it I have obtained an Enterprise Plus rental license and all is good!

To answer your question concreetly, it is not the case that all functions are available to someone with a standard rental license.

[veremin]

I'm not that well versed in licensing, so, I may have confused something in this regard.

Glad to hear that you're up and running now. In the meantime, I will clarify those questions internally to avoid confusion in future.

So, thank you for raising this; appreciated.

[Cookiie]

Hi there,

we created a .net application for collecting data via Veeam RestApi.
In most cases everything is fine, but sometimes we get some errors from our customers.
The Log means 403 - Forbidden. We checked all possible problems. The user is portal administrator, authentication works and we have a valid session created.
Some of the main-data is collected, but eg the list of jobs isn't provided.

Any idea what's going wrong? Need the Portal Administrator any special rights?

Kindly regards
Michael Richter

p.s: actually i have no support case ID

[veremin]

Hi, Michael,

Your post has been merged into existing discussion, kindly, check the answers provided above.

Thanks.

[Cookiie]

Hi there,

thanks for merge. I read this Thread before, but wasn't sure if this is the same problem here.
We still had the Problem during our scan of the veeam data. We checked the accounts, they had the portal admin role in Enterprise Manager and the admin role in Backup & Replication.
If i login with the account in the Enterprise Manager on the browser, i can see anything, the logs and so on, only with RestAPI some data ist missing.

At this state, if have no furter idea or clue what i can do.

[veremin]

Can you tell me what type and edition does your license have? Thanks.

[Cookiie]

Hi,

we contact one of our customer. He has following values:

License Type: Full License
Editon: Enterprise

If i saw it, i recognized thats NOT the plus version, so i think this is the reason. I'm right?

[veremin]

Correct.

[jsunjones]

I had a similar problem with 403 access denied and cloud connect and it turned out I wasn't specifying v=v1_1 as a URL parameter when setting up my session.

I was using postman to review API capabilities

[Alim]

Greetings,

I have issued a GET command to http://xxx:9399/api/hierarchyRoots to retrieve the reference UID for the vcenter and received the following error below:

<?xml version="1.0" encoding="utf-8" ?>
<Error StatusCode="403" Message="Access denied." />

I have checked that the account being used has:

1) domain admin right
2) local admin right to vcenter
3) administrative roles as veeam administrator

Any advise is appreciated. Thanks

[veremin]

Are you using Enterprise Plus Edition? Are you issuing request to the correct version of logon manager (v1_1 is the latest one)? Thanks.

[rlambrechts]

Hello,

I've been testing the Veeam REST API for version 8.0 (looking at: http://helpcenter.veeam.com/backup/80/r ... ng_on.html)
However whenever I try to get the jobs, I get an error 403 back.

Little trace:


POST: http://localhost:9399/api/sessionMngr/?v=v1_1
with Authentication: Basic base64(username:password)

Return message:

Code: Select all

<?xml version="1.0" encoding="utf-8" ?>
 <LogonSession Type="LogonSession" Href="http://localhost:9399/api/logonSessions/493d1c7e-f0aa-475b-b84c-0ffc0a7d05ba">
 <Links>
<Link Href="http://localhost:9399/api/" Type="EnterpriseManager" Rel="Up" />
<Link Href="http://localhost:9399/api/backupServers" Type="BackupServerReferenceList" Rel="Down" />
<Link Href="http://localhost:9399/api/repositories" Type="RepositoryReferenceList" Rel="Down" />
<Link Href="http://localhost:9399/api/wanAccelerators" Type="WanAcceleratorReferenceList" Rel="Down" />
<Link Href="http://localhost:9399/api/reports/summary" Name="Summary" Type="Report" Rel="Down" />
<Link Href="http://localhost:9399/api/backupServers?format=Entity" Type="BackupServerList" Rel="Down" />
<Link Href="http://localhost:9399/api/repositories?format=Entity" Type="RepositoryList" Rel="Down" />
<Link Href="http://localhost:9399/api/wanAccelerators?format=Entity" Type="WanAcceleratorList" Rel="Down" />
<Link Href="http://localhost:9399/api/cloud/gateways" Rel="Create" />
<Link Href="http://localhost:9399/api/cloud/tenants" Rel="Create" />
<Link Href="http://localhost:9399/api/logonSessions/493d1c7e-f0aa-475b-b84c-0ffc0a7d05ba" Type="LogonSession" Rel="Delete" />
 </Links>
<UserName>COMPANY\user</UserName>
<SessionId>493d1c7e-f0aa-475b-b84c-0ffc0a7d05ba</SessionId>
 </LogonSession>

For starter this seems a very odd message, it doesn't contains as much as in the examples.
However I do get a login session back: 'X-RestSvcSessionId: NDkzZDFjN2UtZjBhYS00NzViLWI4NGMtMGZmYzBhN2QwNWJh'

Once use this session id to get to jobs, I get 'Access Denied'.

GET: http://localhost:9399/api/jobs
+ Header: X-RestSvcSessionId: NDkzZDFjN2UtZjBhYS00NzViLWI4NGMtMGZmYzBhN2QwNWJh

Code: Select all

<?xml version="1.0" encoding="utf-8" ?>
<Error StatusCode="403" Message="Access denied." />

I am using the same login account as the one I use in the backup enterprise manager. There everything works.My rights lever is 'Portal Administrator'.

How can I get the jobs? Where is the issue here?

Kind regards,

[veremin]

I'm wondering what product edition you're using. Standard, Enterprise or Enterprise Plus? Thanks.

[rlambrechts]

Enterprise

Kind regards,

[veremin]

That's the reason. You need to be on Enterprise Plus edition to make use of RESTful API functionality. Thanks.