# 403 error when accessing API

**URL:** <https://community.smartthings.com/t/403-error-when-accessing-api/405>\
**Category:** General Discussion\
**Tags:** archive\_developers\
**Created:** [June 19, 2013, 12:54am UTC](https://community.smartthings.com/t/403-error-when-accessing-api/405 "2013-06-19T00:54:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![snoopbuild](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@snoopbuild](https://community.smartthings.com/u/snoopbuild)\
**Post date:** [June 19, 2013, 12:54am UTC](https://community.smartthings.com/t/403-error-when-accessing-api/405/1 "2013-06-19T00:54:49Z")

</div>

Can someone tell me how to get API access from an external web service? All I’m trying to do is flip on a switch, but I am getting a 403 ”AccessDenied, You are not authorized to perform the requested operation.” message.

This is what I’ve done, but I’m not sure if I’m missing something:

- created SmartApp using ”Sample Web Services Application” from ST
- installed/configured SmartApp using iOS app, allowing access to my switch
- using Fiddler HTTP Proxy (for testing), I’m sending an HTTP PUT to [https://graph.api.smartthings.com/api/smartapps/installations/{smart\_app\_id}/switches/{switch\_id}](https://graph.api.smartthings.com/api/smartapps/installations/%7Bsmart_app_id%7D/switches/%7Bswitch_id%7D).  
I’m certain I have the correct smart\_app\_id and switch\_id, as I can see them via API.

HTTP Headers contain:  
Content-Type: application-json  
Authorization: Basic {my\_base\_64\_encoded username:password}

HTTP Body contains:  
{command: on}

However, I get the 403. I can perform other API calls, and they work OK.

Can developers use an API via web service like this to control their things?

---

<div class="post-metadata">

**Author:** ![dlieberman](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dlieberman/32/11827_2.png) [@dlieberman](https://community.smartthings.com/u/dlieberman)\
**Post date:** [June 19, 2013, 12:50pm UTC](https://community.smartthings.com/t/403-error-when-accessing-api/405/2 "2013-06-19T12:50:18Z")

</div>

@snoopbuild - We’re still working to finish up the documentation and tutorials for how to expose web service endpoints from SmartApps. The draft documentation is available here:

> **[SmartThings Web Services Developers Guide](https://docs.google.com/a/smartthings.com/document/d/14F5CnjIbI8Ru4-MrjHXhnBGGQngUevVEe7H3cqoGHKA/edit)**
>
> THIS DOCUMENT IS OUT-DATED. Please see the current SmartThings Developers Guide at: http://docs.smartthings.com SmartThings Web Services Developer’s Guide Integrating with SmartThings using SmartApps Web Services © 2013 Physical Graph Corporation,...

but there are still a couple of sections missing. The main things that are missing are the discovery of your endpoints once the SmartApp is installed:

```auto
HTTP Header:
Authorization: Bearer [your OAuth2 token]

HTTP GET: https://graph.api.smartthings.com/api/smartapps/endpoints

```

Which should return something that looks like:

```auto
200 OK
[
  {
	"oauthClient": {
  	"clientId": "myclient",
  	"authorizedGrantTypes": "authorization_code"
	},
	"url": "/api/smartapps/installations/8a2aa0cd3df1a718013df1ca2e3f000c"
  }
]

```

And making calls to your SmartApp:

```auto
Headers:
Authorization: Bearer [your OAuth2 token]

HTTP GET: http://graph.api.smartthings.com/api/smartapps/installations/8a2aa0cd3df1a718013df1ca2e3f000c/switches

```

Will return a list of switches, and

```auto
Headers:
Content-Type: application/json
Authorization: Bearer [your OAuth2 token]

PUT /api/smartapps/installations/8a2aa0cd3df1a718013df1ca2e3f000c/switches/8a818a9b39c0de7f0139c0dff1290073

Request body:
{“command”: “on”}

```

Will send the on command to a specific switch. I hope that’s helpful, and we should have the documentation completed and tutorials posted soon.

---

<div class="post-metadata">

**Author:** ![mdementen](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mdementen](https://community.smartthings.com/u/mdementen)\
**Post date:** [September 6, 2013, 3:27am UTC](https://community.smartthings.com/t/403-error-when-accessing-api/405/3 "2013-09-06T03:27:54Z")

</div>

Hello Dan,

I followed the unfinished doc mentioned above by snoopbuild, mapped some api functions into my app. I successfully got an access token, retrieved my endpoint url but when I try to retrieve my switches list trough my endpoint url I’m getting an

`HTTP/1.1 500 Internal Server Error.`

Any help would be greatly appreciated.

Thx

---

<div class="post-metadata">

**Author:** ![mdementen](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mdementen](https://community.smartthings.com/u/mdementen)\
**Post date:** [September 7, 2013, 1:36am UTC](https://community.smartthings.com/t/403-error-when-accessing-api/405/4 "2013-09-07T01:36:42Z")

</div>

OK after further research I found out that there was a problem in my web service app.