Receiving "Access Denied" for most API calls

[Anonymous]

I have a custom Service and am attempting to make REST API calls to retrieve activities. In doing so, I am getting nothing but "Access Denied" errors such as:

{"requestId":<...>,"success":false,"errors":[{"code":"603","message":"Access denied"}]}

Some background:

My API user is an Admin. I have checked and double checked that the Admin role has all permissions available

Prior to making an API call, I generate a bearer token using the `/identity/oauth/token?grant_type=client_credentials` endpoint.

I have tried the following endpoints and receive the Access Denied error for each call attempt:

• /rest/v1/activities/pagingtoken.json
• /rest/v1/lists.json
• /rest/v1/leads/...
• /rest/v1/leads/describe.json

The one Endpoint which reliable succeeds is `/rest/v1/stats/errors.json`:

{"requestId":<...>,"result":[{"date":"2016-02-26","total":1,"errors":[{"errorCode":"603","count":1}]}],"success":true}

Are there other permissions that allow my API user to access the specified endpoints? Is there something I'm missing?

Thanks!

Message was edited by: Zack Schultz (Added note about connecting via the identity endpoint first)

[Anonymous]

You need to authenticate first.  Did you runt he authenticate API call?

[Anonymous]

Yes - I should have mentioned that in my original post. I first hit the authenticate API to get an access token. I then use `Authorization: Bearer <my token>` to authenticate each individual call.

[Anonymous · Accepted solution]

Here is the getting started guide:  http://developers.marketo.com/blog/quick-start-guide-for-marketo-rest-api/

[Anonymous]

Looks like you don't have the API role in your permissions.  Are you on Spark edition?

[Anonymous]

I'm working with a customer that also does not have access to these permissions. Do sandbox accounts not have access to those permissions?

[Anonymous]

Looks like all I had to do was create a new Role and the API permissions showed up. Thanks!

[Anonymous]

I didn't mean to imply that I was authenticating before each call. Just that I was supplying the bearer token for each call.

I followed the setup guide and have created a custom service tied to an API only user. I am interested in the note you mention about not having API access. How can I tell what edition I am on? Also, if it's important, I am currently working in our Sandbox environment

[Anonymous]

I am not sure you need to authenticate each call