Workflow Instance get error messages

[Srinivas-Rao]

Hi All,

While I am trying to fetch the workflow instance error messages, I get the following error:-

{ "error": "unauthorized", "error description": "Full authentication is required to access this resource." }

I read through the documentation and found that I might be missing the scope WORKFLOW_INSTANCE_GET_ERROR_MESSAGES, so updated the instance with it. Even then, I continue to get the same error. I am trying to do it via postman by taking the user token first and then using it to launch the required URL.

URL is: https://api.workflow-sap.cfapps.ap10.hana.ondemand.com/workflow-service/rest/v1/workflow-instances/3...

Note: I am using trial and have setup workflow management using booster. For the workflow service, I created one more instance of it and used its credentials in the destination called "Workflow" which is probably taken to reach the workflow management. This new workflow service instance is the one updated with the required scope.

I cannot find what I am missing. Kindly provide some help/pointers to move further.

Thanks & Regards

Srinivas Rao.

[tobias_breyer]

Hi Srinivas,

this is typically not a permission issue. For permission issues, you receive status 403 and a rather clear message. I think the only case when you receive the 401 relating to permission issues is when the token doesn't have any scopes.

It is not clear what "taking the user token" means. If this is a scenario where you authenticate a user, then the scopes of the service instance don't play a role (just the client ID and secret). However, the authenticated user needs to have suitable role collections assigned, from which the scopes are derived and showing up in the token then. For retrieving the token in Postman, I think you would use the OAuth2 Password Grant.

Regards,

Tobias

[Srinivas-Rao]

Hi Tobias - Thanks for the reply. Below is the screenshot of the token where I can see the relevant scopes too( viz. WORKFLOW_INSTANCE_GET_ERROR_MESSAGES ). So, if I understand your point of scopes for the token, then I believe the scope is there.

I am also executing in the postman, with the token URL all placed such that the token is retrieved correctly.

Below is the screenshot of the token related info that I put in. Please let me know if you need any further information to pinpoint the issue.

Thanks & Regards

Srinivas Rao.

[Raghu]

Hello Srinivas,

I always had issue with using tokens with postman. For using workflow APIs, I use the test view of API business Service, SAP API Business Hub (https://api.sap.com/api/SAP_CP_Workflow_CF/testview) It works all the time for me.

Cheers

Raghu

[d_rana]

Hi Srinivas, A snippet from Postman on the GET of error messages which worked. Just updated the service instance "wm_workflow" {created by Booster(in case you following that)} with relevant scope:WORKFLOW_INSTANCE_GET_ERROR_MESSAGES. Hope you have suffixed the access token url with /oauth/token like: https://<trialaccount>.authentication.eu10.hana.ondemand.com/oauth/token . In Postman this needs to be done where as in API Hubits taken care of.

[d_rana]

The screenshot above from Postman

[Srinivas-Rao]

Hi raghuraman.ramakrishnan and d.rana - Thanks for your replies. Attached are the screenshots for the postman where I use /oauth/token suffixed and another screenshot of the scopes added in.

Also, in the API hub, I have exactly the same problem.

Thanks & Regards

Srinivas Rao.

[Raghu]

Hello srinivas1984_rao ,

Thank you for sharing your update.

This is my JSON payload in my workflow instance

{
    "authorities": [
        "WORKFLOW_INSTANCE_GET_ERROR_MESSAGES"
    ],
    "defaultCollectionQueryFilter": "shared"
}

Just to be on the same page, I used this payload when creating workflow instance inside BTP Cockpit.

After this, it works as expected in api.sap.com link I shared with you.

Can you confirm you are using this payload against Workflow Service Instance?

Cheers

Raghu

[tobias_breyer]

Hi Srivinas,

if you use the token created with this Postman UI:

https://answers.sap.com/storage/temp/1961834-capture3.jpg

Then the token will be based on the clientID and clientSecret only, because it is configured with the Client Credentials flow. ClientID and Secret is what you get from e. g. the Booster and by creating service instances, specifying detailed scopes. But this is all for Technical Communication:

https://help.sap.com/viewer/e157c391253b4ecd93647bf232d18a83/Cloud/en-US/baf2847f6d1c401a83ca3a1427b...

But it seems to me, you want your own credentials to work. In this case, you have to use e. g. Password Grant flow.

Regards,

Tobias

[Srinivas-Rao]

Hi Tobias - I want to do the client credentials only, but unfortunately the issue still remains 😞