What is the authorization mechanism

[harneets04]

Hi buddy,

Kudos to your efforts. This has made really easy.

Quick question, I was trying to call the API from postman directly but it is giving me 403 error. I saw your code and you are not using any authentication mechanism. So any idea why it is giving me 403 (forbidden) error?

Thanks!

[harshit-budhraja]

@harneets04 The API which is being used here is one of the public APIs - so there is no auth required. CoWIN has released documentations for two levels of their APIs - public and private. Most likely, if you're getting a 403 Forbidden Error, it's because you might be hitting Postman on a URL which is not a public API (I faced this issue yesterday too 😅).

Here's what I've done now - made a collection of only public APIs which don't need any auth. Feel free to use it if it helps you in any way. Kudos!

https://www.postman.com/harshitbudhraja/workspace/harshit-s-public-workspace/documentation/15207083-2fcc3768-d4ed-4785-b426-830f87135329

[harneets04]

@harshit-budhraja Thanks for your reply. Yes, I saw both private and public. And I am trying for the public only. And their PROD URL. PFB the SS.
I think COVIN doesn't allow requests originating outside of India.

[devsatishm]

@harneets04 Yes, that appears to be the case. Try using India proxy?

[satyamsovan123]

@harshit-budhraja I'm also trying to get vaccination details, but I'm getting access forbidden. It would be great if you could help me out.

[goodbadwolf]

@satyamsovan123 I had the same issue. I was able to fix it by using an Indian proxy (or disabling a US one if you have any)

[harshit-budhraja]

@goodbadwolf @satyamsovan123 @devsatishm @harneets04
I think the issue could be something else and completely unrelated to your geolocations. Here's a quick little experiment I did to check this - Tried hitting the CoWIN APIs from 3 different IP addresses (proxied via 3 different countries - India, US, UK) and I got 200 OK responses from each one of these trials.

IP Addresses used: 49.36.107.108 - India, 173.0.48.162 - US and 78.129.138.235 - UK.

PFB the screenshots.

[harshit-budhraja]

@harshit-budhraja I'm also trying to get vaccination details, but I'm getting access forbidden. It would be great if you could help me out.

@satyamsovan123 As far as your issue is concerned - can you check the baseUrl which your request is using? I'm sure you'd be using something like https://api.sit.... Please make sure to use their CDN APIs instead - https://cdn-api... and it'll work. You can use this collection that I've created - https://www.postman.com/harshitbudhraja/workspace/harshit-s-public-workspace/documentation/15207083-2fcc3768-d4ed-4785-b426-830f87135329

[harshit-budhraja]

Also, one more thing I just noticed - Hitting the APIs from Postman's Web Platform gives a Forbidden error, while doing the same from the desktop app works! Not clear if the downstream is blocking certain agents or origins, would need to explore this further.

[satyamsovan123]

Still the same error! 😭 And I'm only using the Indian network.

[princeraheja1998]

My question is how u get these api's link and is there mistake by arogya developers not adding authorization in these api

[rahu619]

I could only retrieve data from their Test server. As for the production server one, I'm getting this 403 Forbidden access like many others here.

@harshit-budhraja I have tried playing around with the cdn API links in my postman windows application, and still have authorization issue.

[satyamsovan123]

@princeraheja1998 You can get the API links here - https://www.postman.com/harshitbudhraja/workspace/harshit-s-public-workspace/documentation/15207083-2fcc3768-d4ed-4785-b426-830f87135329

All of them are available to public, @harshit-budhraja has compiled the endpoints. And, I believe something is wrong at their end. And, they haven't fixed it yet.

[satyamsovan123]

For those who are getting errors by passing values, here -
{{baseUrl}}/v2/appointment/sessions/public/calendarByPin?pincode=110001&date=31-03-2021&vaccine=COVISHIELD

I had to go other way round. First I fetched the states, and got hold of stateID from here -
{{baseUrl}}/v2/admin/location/states
Then, I fetched the district with the stateID, and stored the selected districtID along with date (from input) -
{{baseUrl}}/v2/admin/location/districts/:stateID
So, now I used (districtID + date) for getting the vaccine details from here -
{{baseUrl}}/v2/appointment/sessions/public/findByDistrict?district_id=districtID&date=date

baseUrl which I used was - https://cdn-api.co-vin.in/api/

I know it's long, and also let me tell you that initially it was working, but for some reason, instead of getting JSON in my console, I'm getting HTML as output from the third step (it says 403 ERROR !). However, if I use the above URL in browser, it works fine.

Let me know if anyone can help. Thanks!