Any Postman / ARC experts out there for some Oauth 2.0 action..

gigeorge · 22 Feb 2019 at 01:23

Hi
I'm working on a project to get data from HMRC for MTD (individuals or businesses that take home £85k or over), it goes live 1/4/19. My application, SAP PI doesnt have the ability to program the calls, so i have to use POSTMAN to simulate the calls. I can do the basics but when it comes to getting Oauth 2.0 resolved to pass credentials to the next respective api call to say a report on tax to date, i just cant seem to get the Oauth 2.0 Get working.
Does anybody know of any good guides on getting Oauth 2.0 to work with postman or arc, i've searched SAP SCN and scoured github but its all based around programming the commands in rather than using a test tool like Postman.
I'd really appreciate it if you could guide me to good resources of if you were willing, assist me. I'd be willing to pay for your time.
Many thanks,

PaulStat · 23 Feb 2019 at 08:22

Which oauth flow? Code grant?

How far have you got? Have you got as far as getting an access token?

gigeorge · 24 Feb 2019 at 00:16

Ive got as far as using their hello world basic call and then using my credentials but not getting an access token..

PaulStat · 24 Feb 2019 at 10:37

Do you have a link to the API?

gigeorge · 24 Feb 2019 at 22:14

Unfortunately you have to register but can be done by going here:

https://developer.service.hmrc.gov.uk/api-documentation/docs/mtd

PaulStat · 26 Feb 2019 at 08:18

gigeorge said:
then using my credentials but not getting an access token..

I think the main problem with trying to use Postman to do this is after you authenticate by typing in your credentials the authz code grant flow is kicked off. This actually does a HTTP 302 redirect to a URI of your choice with the authorisation code as part of the URL. This is then used in exchange for an access token by doing a POST request.

You might be able to do the initial entering of credentials and enter a redirect_uri that doesn't exist (remembering of course that the same has to exist in the config of the app you created in their interface). This'll take you to somewhere like
https://www.example.com?code=TBC&state=123e4567-e89b-12d3-a456-426655440000. Use those query params to form your POST request in exchange for an access token. (Again another redirect URI is needed here, usually in order to consume the token)