QRS API 403 error when creating tags

[SimonMinifie]

Hi All,

Have managed to connect and retrieve data when connecting via powershell to teh QRS API, but the goal here is to automate the creating of a load of tags. 

At the moment, any POST request results in a 403. Can anyone spot what I'm missing? 

$qlikserver = 'server1'

$xrefkey = "12345678qwertyui"

$url = "https://server1:4242/qrs/tag?xrfkey=12345678qwertyui"
$headers = @{}
$headers.Add("X-Qlik-xrfkey","$xrfkey")
$headers.Add("X-Qlik-User","UserDirectory=Internal;UserId=sa_scheduler")
$headers.Add("Header","myuser")
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My" | Where {$_.Subject -like '*QlikClient*'}

# Http body for REST API call
$httpBody = @{ id="00000000-0000-0000-0000-000000000000"}, @{ name="Tag1" }, @{ privileges="null" }, @{ impactSecurityAccess="false"}, @{ schemaPath="Tag" }, @{ modifiedbyusename=""}| ConvertTo-Json -Compress -Depth 10

Write-Host $httpBody

Invoke-RestMethod -Uri $url -Method POST -Headers $headers -Body $httpBody -ContentType 'application/json' -Certificate $cert

[alex_colombo]

Hi @SimonMinifie I tried to create a Tag with Postman. I see these differences:

1. You are missing priviliges parameter as query string (I see you put it into the body, please remove it from there)
2. Your body has wrong structure

Below my request
Url: https://qmi-qs-585b:4242/qrs/tag?Xrfkey=0123456789abcdef&privileges=true

Headers: X-Qlik-Xrfkey: 0123456789abcdef, X-Qlik-User: UserDirectory=qmi-qs-585b; UserId=qlik

Body

{"name":"Tag"}

[SimonMinifie]

Hi Alex,

Thank you for the pointers, although I may have missed something as the response still remains as a 403.

I'll have another play with it tomorrow and update here. 

Thanks,

Simon

[stefanstoichev123]

I havent tried with PS recently but usually im getting 403 when im using the wrong certificates (or there is something  wrong with them)

Stefan

[NadiaB · Accepted solution]

Hi @SimonMinifie 

There is a header called "header" not sure that was left by mistake, the other thing is that if you are reading the certificate from the cert store, make sure you run your powershell as the service account, or you can export the certificate and instead of reading from the cert store read from the exported certs (files).

I did a quick test and this worked for me:

$url = "https://qlikserver3.domain.local:4242/qrs/tag?xrfkey=12345678qwertyui"
$headers = @{}
$headers.Add("X-Qlik-xrfkey","12345678qwertyui")
$headers.Add("X-Qlik-User","UserDirectory=domain;UserId=administrator")
##$headers.Add("Header","myuser")
$cert = Get-ChildItem -Path "Cert:\CurrentUser\My" | Where {$_.Subject -like '*QlikClient*'}

# Http body for REST API call
$httpBody = @{

"name" = "SampleTag"

};

Write-Output $httpBody
Write-Output $url

Invoke-RestMethod -Uri $url -Method POST -Headers $headers -Body ($httpBody|ConvertTo-Json) -ContentType 'application/json' -Certificate $cert

you will get a response like this:

Name Value
---- -----
name SampleTag
https://qlikserver3.domain.local:4242/qrs/tag?xrfkey=12345678qwertyui

id : 5c1f0f20-9c92-4b77-a88b-354f1f4a0d4b
createdDate : 2023-01-26T04:23:42.894Z
modifiedDate : 2023-01-26T04:23:42.894Z
modifiedByUserName : DOMAIN\administrator
name : SampleTag
privileges :
schemaPath : Tag

Hope it helps!

[Marc]

If we look at the output you are generating with the HTTPBody

We can see that this is creating an Array of 6 unique objects with one property each

what you really want is something more along the lines of this

# Http body for REST API call
$httpBody = @{ id="00000000-0000-0000-0000-000000000000"; name="Tag1";privileges="null"; impactSecurityAccess="false"; schemaPath="Tag"; modifiedbyusename=""}| ConvertTo-Json -Compress -Depth 10

which generates 1 object with 6 properties

having said that, as @NadiaB  shows in her example in order to create a new Tag you only need to supply the Tag name.

Or to simplify things even further.

you can use one of the available PowerShell modules for interacting with the QRS APIs QlikSenseCLI or Qlik-Cli-Windows 

in QlikSenseCLI this would look like this

Import-Module C:\ExportedPath\QlikSenseCLI

$ServerName = "Server1"
$UserName = "Internal\sa_api"
$Cert = Get-ChildItem -Path "Cert:\CurrentUser\My" | Where {$_.Subject -like '*QlikClient*'}
Connect-QlikSense -Hostname $ServerName -Username $UserName -Certificate $Cert

#Create the local object
$NewTag = New-QSTag -Name "Tag1"

#Add the Object to the Sense server
$QSNewTag = Add-QSTag -TagObj $NewTag