Using canvas API to access files and modules as a student

[alexolowo]

Hi, 

I am a student working on a project that hopes to integrate Canva's API to make some tool for progress tracking in all courses. The problem I am running into at the moment is with viewing files and modules as a student. When I send a request I get the 401 code back which means I am not authorized. I was wondering why this would be the case as on my course websites I am able to see files and modules. My initial guess is that the response of that request would list all the files both published and unpublished and I am assuming that its the same for modules.

My question is; using the API is there a way I can get a list of published files and modules?

Let me be more specific. I am using Postman to query the API and yes I have gotten my bearer token and I am authorizing API access using the bearer token. In terms of API requests that I have gotten to work, I have gotten a list of all my courses using the GET api/v1/courses endpoint, my enrollments by using the GET api/v1/users/:user_id/enrollments and my user info with the endpoint that you specified earlier. 

The issue comes from when I try to perform a GET api/v1/courses/:course_id/files or a GET /api/v1/courses/:course_id/modules. The resulting message is as follows:

{

"status": "unauthorized",

"errors": [

{

"message": "user not authorized to perform that action"

}

]

}

For additional context, I replace :course_id with a course ID from the following table i queried for enrollments (see the attached image).

Please let me know for any additional questions.

Thank you!

[James]

@alexolowo 

You don't tell us what you've tried, so it's difficult to provide specific guidance.

Have you generated an access token and included it in the header so that Canvas knows who you are? All REST API requests require authentication and authorization.

Have you gotten any API request to work? Or is this the first one you're trying? Start with something simple that requires no special codes such as GET <instance>/api/v1/users/self. Until you can get that working, you shouldn't expect anything else to work.

Are you sure that you have the right IDs in the List files endpoint? If you typed the course ID incorrect, then you would be unauthorized to view the files for that course because it's not your course.

You should not expect to see a list of unpublished files as a student. If you do not have access to the file in Canvas, you should not expect to be able to access it through the API.

[alexolowo]

Hello @James ,

Apologies. Let me be more specific. I am using Postman to query the API and yes I have gotten my bearer token and I am authorizing API access using the bearer token. In terms of API requests that I have gotten to work, I have gotten a list of all my courses using the GET api/v1/courses endpoint, my enrollments by using the GET api/v1/users/:user_id/enrollments and my user info with the endpoint that you specified earlier. 

The issue comes from when I try to perform a GET api/v1/courses/:course_id/files or a GET /api/v1/courses/:course_id/modules. The resulting message is as follows:

{

"status": "unauthorized",

"errors": [

{

"message": "user not authorized to perform that action"

}

]

}

For additional context, I replace :course_id with a course ID from the following table i queried for enrollments (see the attached image).

Please let me know for any additional questions.

[James]

@alexolowo 

I know this sounds like a stupid question, but does the person who the access token belongs actually enrolled in the course you're trying to access the files and modules from?

At first, I wondered if the API was forbidden to students. That didn't make senses, so I tested both the course/xxx/files and course/xxx/modules API endpoints with an access token belonging to a student account and it worked correctly.

Since that worked, it made me wonder about the owner of the access token. Sometimes, even with my admin access, I am unable to get a response for certain requests because I'm not enrolled in the course. I have to masquerade as a user.

That shouldn't be the issue here. If I try to use that student access token to access another course that they are not enrolled in, then I get a 403 forbidden error (not 401) but with the the response you're saying.

If I supply an incorrect token, then I get a 401 error, but it says "invalid access token".

That suggests that the access token is correct, but that the user with the access token isn't enrolled in the class.

Can you verify that the course ID you get with /api/v1/courses includes the course ID for the course you're trying to access? You may want to add ?per_page=100 to the end if that token has access to more than 10 courses.

[alexolowo]

@James 

I appreciate the help! Any question is welcome.

I believe that they are because if we look at the image i attached previously, they all have enrollment state as 'active' and role as 'StudentEnrollment'. Is it possible for the api/v1/users/:user_id/enrollments endpoint to return that list if the student is not enrolled in those courses? I can verify that the Course ID i am using to access the files is the same as the one returned from the /api/v1/courses endpoint

As a followup, I noticed that in your demo URL's, the course ID is only 3 digits 'XXX'. is that the format of a course ID? because the table i attached earlier has a 6 digit course ID format.

Thanks

[James · Accepted solution]

xxx was just a placeholder. It can be any length.

When I tried the course enrollments as a student who was not in the course, I got a 403 error with the error message you gave. You said you got a 401 error -- was that a typo?

There is a difference. 401 means the credentials were not correct. 403 means the server understood the request but you do not have permissions to access it.

Are we positive that the course in question is published and that you can visit it within Canvas?

Here's another trick/check. Log into Canvas (web interface) and go to the course you're having problems with. Add /api/v1 at the beginning of the path (after the hostname) and then /files or /modules to the end of the path. It should look like <instance>/api/v1/courses/xxx/files or <instance>/api/v1/courses/xxx/modules. Then hit enter. If it works there but not through the API, then it's likely an authentication error. If it doesn't work there, it's something to do with the course.

Can you get /files or /modules for any course or is it just one throwing the issue? If just one, then it's something about that course -- such as being unpublished.

[alexolowo]

Okay, so I think I know what the problem is. I was doing all this testing on the Beta environment and i think the permissions there for students are virtually none existent. This is because when I used the URL with the Beta instance like you suggested, I got an access denied screen but with the production instance I got the modules. I didn't get the files however because the files section is either published or unpublished as this depends on the course instructor. When I tested this for a course that did have the files section published, it was successful. 

Thank you so much for all your help and the troubleshooting! I appreciate it greatly.