Permission or Bad EndPoint?

[JackThor]

Hello,

I am a programmer recently assigned to support canvas and I am using Post Man to test out the API and I am encountering an issue with the search all API endpoint. The end point I am using is this, /api/v1/search/all_courses?public_only=1&per_page=100 and I am getting a unauthorized error, 

{

    "status": "unauthorized",

    "errors": [

        {

            "message": "user not authorized to perform that action"

        }

    ]

}

any ideas on what the issue can be? I talked to my Admin and they said they don't see any API specific permission. So I was wondering am I calling the API end point incorrectly? Or do I need elevated permission unrelated to the API? The reason I am thinking this is because while I was playing with the API end point for courses setting there were some courses that I could not get or update. 

Any help, or direction would be appreciated.  

[DecoyLex · Accepted solution]

What happens if you go to https://[your canvas ur]l/search/all_courses/?

The List all courses API will show this error if the public course index is disabled: https://github.com/instructure/canvas-lms/blob/0045d19ea8f237443c560beb6aa6a1cd38bb4831/app/controll.... That is to say, your admin would need to enable the setting titled, "Show a searchable list of courses in this root account with the 'Include this course in the public course index' flag enabled."

As for whether you're using the API correctly, this API also only lists the courses that specifically opt in to showing up on that public course index. If you're looking for an API to search all courses, that'd be in the Accounts API: https://canvas.instructure.com/doc/api/accounts.html#method.accounts.courses_api. To get all courses in the Canvas instance, you'd use the /api/v1/accounts/self/courses endpoint. If your intention is only to show the courses that are in the public course index, you're using the right endpoint.

More generally, I'm assuming you're using a personal access token (i.e., you went to your user settings and clicked + New Access Token), your API access will match the access of the person who generated the access token (likely your own). If you're using a developer key with an OAuth2 authorization flow, your access will match that of whomever clicked the authorize button when launching the app. If the developer key has scopes enabled, your access is the cross-section of the user's permissions and the scopes for which the access token is allowed.

I hope this helps!

[JackThor]

This looks promising. I went to  https://[your canvas url]/search/all_courses/? and got an access denied screen. This is progress 😄 

In regards https://canvas.instructure.com/doc/api/accounts.html#method.accounts.courses_api, I was originally using that but it only listed active courses and I was informed that I need to access some inactive courses which lead me to the search all. Hoping the public course index would be broad enough to capture the courses they want.

Thanks for you help. I will let you know how things goes.

[DecoyLex]

In my experience, the number of courses I get back from the public courses index is typically much smaller than the results I get back from the accounts API, though it's possible my school's Canvas instance is set up differently from yours, so your mileage may vary.

If I remember correctly, the GET /api/v1/accounts/:account_id/courses endpoint needs an extra parameter to return inactive courses. Glancing at the documentation, the state[] parameter should be what you're looking for. For instance, doing a GET /api/v1/accounts/self/courses?state[]=all call should return everything, including deleted and unpublished courses, but it's possible I could be missing something.

It's also possible that Canvas's pagination could be tripping things up. Even if you set the per_page parameter absurdly high, Canvas will still limit the maximum number of returned records to 100.

Either way, I hope you're able to get your API call working.

[chriscas]

Hi @JackThor,

I actually don't quite know what Instructure means by "active courses" for that API.  When I want to list courses, I always use the account/courses endpoint that @DecoyLex linked to, and it lists every course in the account (other than deleted courses) by default for me.  I'd be curious to know whether you tried it and found that there were courses missing from the results there, and if so, how were those courses unique (end date, term, concluded status, etc)...

-Chris