Error 403 when calling Process Automation API on deployed SAP Build App

[v_blum2000]

Hi all,

currently i'm facing an issue, where I receive an error 403 on trying to start my Process Automation workflow with this API: https://api.sap.com/api/SPA_Workflow_Runtime/path/post_v1_workflow_instances.
It's working when I start it with Postman. On the preview-version from SAP Build Apps it is also working fine.

But on the deployed version it isn't working. 
I found out, that the bearer token is missing:

The common request header is filled. It looks like the data query "query.authConfig.authToken" is empty.

Does anybody has an idea what's wrong here? In the past it worked like a charm.

Thanks,
Vincent

[Dinu]

The header you have marked "Authorization: Bearer undefined" is fine. The token is filled by the router to which this request is send. What is the path of the request? It should end in "workflow/rest/v1/workflow-instances". From the name (on the left), it appears to be wrong. It is fine if you have configured the destination with a url including this path. 

Check the payload/response. Sometimes it has some more information.

[v_blum2000]

Hi Dinu,

[v_blum2000]

Hi Dinu, thanks for your information.

I've set the API path in the destination and choosed this destination on the SAP Build App.
The API path is https://<xxx>.hana.ondemand.com/workflow/rest/v1/workflow-instances
The Token URL is https://<xxx>.authentication.<xxx>.hana.ondemand.com/oauth/token 

The payload looks good. I can copy it direct to postman and it works. The response just says error 403 - forbidden

My Client Secret and Client ID is also correct.

[Dinu]

I meant to say that the preview/response in the browser's developer tools may reveal the reason. One possibility is that the user used for the designer/preview is not the one using the deployed app. Most times you can have the same email in IAS and in SAP ID service. These are 2 different users. You can go and grant the same roles as the user from IAS (Custom IAS tenant) to the user with from, SAP ID (default identity provider) service.

[v_blum2000]

Hey guys,

we could solve it. The problem was my destination path.
I've set the complete URL to the API Endpoint, which caused this error.

To solve this issue, just set the url without the path - like that:
https://<host>.cfapps.<region>.hana.ondemand.com

and in sap build apps (DATA -> API), set the path after the Domain: