# Has anyone gotten the API to work?

**URL:** <https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101>\
**Category:** Ignition 8.3 Early Access\
**Created:** [July 29, 2025, 6:31pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101 "2025-07-29T18:31:01Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![mquinn](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mquinn](https://forum.inductiveautomation.com/u/mquinn)\
**Post date:** [July 29, 2025, 6:31pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/1 "2025-07-29T18:31:01Z")

</div>

I've been trying to play around with the API but I keep bouncing off the unauthorized error. I'm trying:

```python
curl -H 'Authorization: Bearer TestToken3:<secret jibberish>' https://<myserver>:8043/data/api/v1/gateway-info

```

Then I get back:

```python
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/>
<title>Error 401 Unauthorized</title>
</head>
<body><h2>HTTP ERROR 401 Unauthorized</h2>
<table>
<tr><th>URI:</th><td>/data/api/v1/gateway-info</td></tr>
<tr><th>STATUS:</th><td>401</td></tr>
<tr><th>MESSAGE:</th><td>Unauthorized</td></tr>
</table>

</body>
</html>

```

I've checked and my token is enabled.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [July 29, 2025, 6:34pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/2 "2025-07-29T18:34:06Z")

</div>

It's not an authorization/bearer token (I don't remember the reason why).

Pass your token as the value (no preamble) of a `X-Ignition-API-Token` header.

---

<div class="post-metadata">

**Author:** ![mquinn](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mquinn](https://forum.inductiveautomation.com/u/mquinn)\
**Post date:** [July 29, 2025, 6:37pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/3 "2025-07-29T18:37:46Z")

</div>

Like this:

```python
curl -H 'X-Ignition-API-Token: TestToken3:<secret>' https://<server>:8043/data/api/v1/gateway-info

```

Because now I get a forbidden error.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [July 29, 2025, 6:50pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/4 "2025-07-29T18:50:56Z")

</div>

What security levels does your token have? It has to be given a permission that has read access to the gateway:

In `/app/platform/security/settings`:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/0/e00f08190b2f8a3e653e69e3c48dc4bda6800c88.png)

In `/app/platform/security/api-keys`:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/e/5e7cc42fff370f1c5509f28d36d6ad1f79cbe548.png)

`curl -H 'X-Ignition-API-Token: test:xxx' http://localhost:8088/data/api/v1/gateway-info`  
Returns:

```json
{
    "allowUnsignedModules": true,
    "deploymentMode": "",
    "edition": "standard",
    "hostname": "localhost",
    "ignitionVersion": "(Dev Version)",
    "jvmVersion": "17.0.15",
    "license":
    {
        "expirationDate": "Jul 29, 2025, 11:46:15 AM",
        "licenseRestrictions":
        [],
        "mode": "Trial",
        "validForVersion": 0
    },
    "name": "Ignition-DV-pgriffith-MBP",
    "port": "8088",
    "redundancyRole": "Independent",
    "timeZone": "Pacific Standard Time",
    "timeZoneId": "America/Los_Angeles"
}

```

---

<div class="post-metadata">

**Author:** ![mquinn](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mquinn](https://forum.inductiveautomation.com/u/mquinn)\
**Post date:** [July 29, 2025, 7:06pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/5 "2025-07-29T19:06:29Z")

</div>

I don't have an API checkbox in my gateway permissions configuration:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/8/186566ebbf1d89e80e42ed17f86d0de5b2f9b423.png)  
This gateway was on 8.1 and upgraded. Maybe the upgrade didn't really get everything?

---

<div class="post-metadata">

**Author:** ![Brad\_Fischer](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/brad_fischer/32/84857_2.png) [@Brad\_Fischer](https://forum.inductiveautomation.com/u/Brad_Fischer)\
**Post date:** [July 29, 2025, 7:10pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/6 "2025-07-29T19:10:53Z")

</div>

You'll need to create a new Security Level. Go to [http://gatewayIP](http://gatewayIP):Port/app/platform/security/levels, highlight "Public" and select "Add Level". Make sure you update your API Key to use this new level.

---

<div class="post-metadata">

**Author:** ![mquinn](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mquinn](https://forum.inductiveautomation.com/u/mquinn)\
**Post date:** [July 29, 2025, 7:20pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/7 "2025-07-29T19:20:22Z")

</div>

That's got it, thank you.

Note for the devs: the API docs show a bearer token in their example. This is confusing.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [July 29, 2025, 11:23pm UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/8 "2025-07-29T23:23:08Z")

</div>

> [@mquinn](#):
>
> the API docs

Which API docs are you referring to by this? Not doubting you - just trying to see where we can iron out the confusion.

---

<div class="post-metadata">

**Author:** ![Ghost](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ghost/32/78380_2.png) [@Ghost](https://forum.inductiveautomation.com/u/Ghost)\
**Post date:** [July 30, 2025, 12:50am UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/9 "2025-07-30T00:50:09Z")

</div>

It's the example at the bottom in the manual for openapi. I tried this earlier and was also unsuccessful. I couldn't get it to work using a Perspective HTTP binding either, but I didn't have any security levels setup.

> **[API Documentation | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/platform/gateway/openapi)**
>
> The API documentation in the Gateway provides a complete, dynamically generated specification of the HTTP API routes made publicly available by the Gateway and installed modules. These routes allow external systems to securely interact with Ignition...

curl -H "Authorization: Bearer YOUR\_TOKEN" \   
https://:8088/data/mymodule/api/v1/getItem/abc-123

Edit: BTW, this openapi is amazing! You guys did an amazing job with all of 8.3 but this especially is mind blowing to me.

I've seen some of the endpoints working as you can put the link in another tab in your browser if you're signed in with someone with authorization in another tab.

---

<div class="post-metadata">

**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\
**Post date:** [July 30, 2025, 5:54am UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/10 "2025-07-30T05:54:11Z")

</div>

> [@Ghost](#):
>
> I've seen some of the endpoints working as you can put the link in another tab in your browser if you're signed in with someone with authorization in another tab.

Yes, because the browser session is being used as the requester. Note that you'll only be able to perform GET requests via this method. Any sort of update request (create/edit/rename/copy/move/delete) will need to be done via a terminal or ReST client, like Postman or Bruno.

---

<div class="post-metadata">

**Author:** ![Ghost](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ghost/32/78380_2.png) [@Ghost](https://forum.inductiveautomation.com/u/Ghost)\
**Post date:** [July 30, 2025, 6:37am UTC](https://forum.inductiveautomation.com/t/has-anyone-gotten-the-api-to-work/109101/11 "2025-07-30T06:37:16Z")

</div>

Postman worked as well as a script in the script console.  
I'm guessing the HTTP binding isn't setup to use the "X-Ignition-API-Token" in the header as it's not an option in the dropdown. I get this error in the output console:

"23:33:41.053 [Browser Thread: aecfbd1b-fd53-4065-ae8a-319200789da7] WARN Perspective.Designer.Workspace -- level: WARNING  
message: "store.Designer: Failed to write to component '0'. TypeError: Cannot destructure property 'readyState' of 'this.webSocket' as it is null."  
line\_number: 2  
source: "[http://localhost:8088/res/perspective/js/PerspectiveClient.c5eb5a2782e4a5c4105b.js](http://localhost:8088/res/perspective/js/PerspectiveClient.c5eb5a2782e4a5c4105b.js)""

> **binding**
>
> {  
> "type": "http",  
> "config": {  
> "request": {  
> "url": ""[http://192.168.1.41:8088/data/api/v1/scan/projects\](http://192.168.1.41:8088/data/api/v1/scan/projects%5C)"",  
> "method": "GET",  
> "auth": {  
> "type": "None",  
> "value": ""  
> },  
> "header": [  
> {  
> "key": "X-Ignition-API-Token",  
> "value": ""test:fzwImhOK7ppGRqT-URDJw5iKAxKoYQOQ0tYLB8ExeTQ""  
> }  
> ]  
> },  
> "polling": {  
> "enabled": false,  
> "rate": "30"  
> },  
> "enableCookies": true,  
> "enableValueCache": true,  
> "connectTimeout": 60000,  
> "socketTimeout": 60000  
> }  
> }