Keep getting "Forbidden" status trying to call the API

API
1

Hello guys,
I want to validate some comments with the AutoMod and I saw that I can use the Check AutoMod Status method. I try to do this using an app. I’ve gone trough the following steps:

  1. Create an app get client_id and client_secret
  2. Get a CODE using https://id.twitch.tv/oauth2/authorize, redirect to localhost set scope to moderation:read.
  3. Copy the CODE and use it to generate an ACESS_TOKEN using https://id.twitch.tv/oauth2/token
  4. Copy the ACESS_TOKEN and try to use it to Check AutoMod Status here https://api.twitch.tv/helix/moderation/enforcements/status

I get

{
   "error": "Forbidden",
  "status": 403,
   "message": ""
 }

Can you please tell me what am I doing wrong?
Thanks!

2

You did call this API with a token from the broadcaster

as per Reference | Twitch Developers

Provided broadcaster_id must match the user_id in the auth token.

So do do a “check” on Ninja’s channel you need a token from Ninja
To do a “check” on Lirik’s channel you need a token from Lirik.

3

I’m guessing you mean the second step “Get a CODE using https://id.twitch.tv/oauth2/authorize” where a manual action is needed to grant permission. Here I just allow it for my channel which is the same as braodcaster_id

4

Can you show the full request you are making to the status API (with token redacted)

5

I do not quite understand what you mean, sorry :smiley:

6

Please show your code.

7

I don’t have any code yet, I’m just using a REST client

8

Then show that.

9

Step 1:

GET https://id.twitch.tv/oauth2/authorize

    ?client_id=<client_id>

    &redirect_uri=http://localhost

    &response_type=code

    &scope=moderation:read

Step 2:

POST https://id.twitch.tv/oauth2/token
    ?client_id=<client_id>
    &client_secret=<client_secret>
    &code=<code>
    &grant_type=authorization_code
    &redirect_uri=http://localhost

Step 3:

POST https://api.twitch.tv/helix/moderation/enforcements/status?broadcaster_id=<broadcaster_id> HTTP/1.1
Authorization: Bearer <access_token>
Client-id: <client_id>
Content-Type: application/json

{
  "data": [
    {
      "msg_id": "someid",
      "msg_text": "there was a time",
      "user_id": "some_user_id"
    }
  ]
}
10

Looks like it’s broken.

if I call with a “incorrect” broadcaster_id I get a 403
If I call with a “correct” broadcaster_id I get a 500

Reporting issue now

11

This means I have the wrong broadcaster_id ? I put my twitch username there. I tried with the numerical ID but still “Forbidden”.

12

All I can tell you is that it’s completely broken.

Added my findings to

13

:frowning: Thanks man! I guess I’ll just follow the issue

14

Also, the example for Check AutoMod Status in the docs does not include a broadcaster_id: Reference | Twitch Developers. Just sayin’ :smiley:

15

Is some_user_id a real user ID if it’s not then you get an unexpected result (500)

If broadcaster_id in the URL doesn’t match the user ID in the token you get a 403.

So we need to debug your issue further

16

Yes, the some_user_id is a real id, and the broadcaster_id is the one who allowed the code generation at step 2.

17

Then I’m not sure why it’s not working for you.

I retested the API with real data and it’s working fine for me. My initial mistake was using the user ID from the example in the docs which is a dead user

If I run

using broadcaster_id or 15185913

{
  "data": [
    {
      "msg_id": "cat",
      "msg_text": "Hello World!",
      "user_id": "15185913"
    },
    {
      "msg_id": "393",
      "msg_text": "Boooooo!",
      "user_id": "15185913"
    }
  ]
}

I get the expeceted result

{
  "data": [
    {
      "msg_id": "cat",
      "is_permitted": true
    },
    {
      "msg_id": "393",
      "is_permitted": true
    }
  ]
}

My tokens validate output

Using https://barrycarlyon.github.io/twitch_misc/examples/token_checker/ to check

image

So all I can see is it’s working as expected here

So we need to work thru your steps further.

This being my rest clients (insomnia) test output.

image
image1584×430 23.2 KB

18

Ok, I tested, and it worked for me also. The problem was that I didn’t use a numerical “user_id” and “broadcaster_id”. I thought that user_id refers to the author of the message, not the broadcaster.
Thanks a lot!

19

Yeah that’ll do it

Err it does, you just have to use the ID of the user not the users login.

The screenshots I used above are a bad example as I used my own ID in both.

So Practical example:

You want to test that a message of Hello World! from noylraCyrraB that is to be tested against the AutoMod on channel barrycarlyon

The URL is

https://api.twitch.tv/helix/moderation/enforcements/status?broadcaster_id=15185913

And the headers contain a token for 15185913

And the JSON POST body is

{
  "data": [
    {
      "msg_id": "cat",
      "msg_text": "Hello World!",
      "user_id": "61788418"
    }
}

As a message from the broadcaster in the broadcasters own channel will always pass automod.

20

Thanks a lot man! It works like a charm :smiley: !!!