403 forbidden when trying to list campaigns via Python or Curl

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I have a python script running just fine to list all of the applications we have in SailPoint.

I then alter it to list all of the campaign. I’m using the same config.json that is working for the app lister, but I get a 403 Forbidden every time, even though the personal access token has admin rights.

Clues please?

It seems to die here using the V3 or 2025 API, and this is a line straight from the example:

results = CertificationCampaignsApi(api_client).get_active_campaigns()

The error is:
403 Forbidden - The server understood the request but refuses to authorize it.

I’ve seen other threads where the user scope was the problem causing the 403 errors, but I’m using a personal access token with admin rights so I’d like to think my user context is going along with it. Plus, the same config.json works for listing apps, just not for listing campaigns.

Thanks in advance…

2

Are you using the Python SDK?

3

Hi Mark, thank you for your reply.

I am using the Python SDK, and I’m glad you asked because I found the answer to my original question and I want to put it here so other people can find it.

I had to enable sp:scope:all and then the 403 forbidden error went away. I was then able to dump information out using the get_active_campaigns() API call with python. I set this scope by editing my personal access token at https://(my tenant).identitynow.com/ui/d/user-preferences/personal-access-tokens

Unfortunately, it wasn’t immediately obvious to me that I had to do this in the documentation, but now it’s working just fine.

My next challenge is to convince the SDK and API to identify the applications associated with each campaign. Tips welcome…

Jeff

4

In that case I would use postman to figure out which API I would need to target. postman is great for being able to fully understand the API’s call and responses and make it a lot easier to build custom scripts as you will already know what you need to pass to the SDK.

Hope this helps.

5

I wish there was a way to get at this information without writing code, but it appears that I need to iterate through the list of campaigns created by get_active_campaign, and for each campaign use get-campaign-template to gather information about the entitlements for that campaign.