Bookings API By ID, returns 403 in postman, curl and custom apps, works fine on online API test tool

Prashant Soni 1

We have deployed our custom app which consumes delegated graph AD app token for GET /bookingBusinesses/{id} API in our client environment.

This token works fine with online API test tools like reqbin and webtools.

However, it fails with 403 forbidden for a console app, deployed Azure API app, azure function, CURL, Postman.

Response Body:

{"error":{"code":"Forbidden","message":"Forbidden","innerError":{"date":"2021-08-31T13:32:09","request-id":"a10a3885-e96e-43b0-a242-11dff032f17a","client-request-id":"a10a3885-e96e-43b0-a242-11dff032f17a"}}}

We have set up the AD app in different tenants and it is working fine but it does not work in the client's tenant on custom apps and postman.

The same token is working with online tools but not with custom apps and azure functions.

Is there any restriction that can be set up to block calls from certain clients?

I have attached the token parsed diff file if that can help.

CarlZhao-MSFT 44,666 Reputation points

2021-09-01T06:15:18.143+00:00

Use https://jwt.ms/ to parse your access token and provide screenshots.
CarlZhao-MSFT 44,666 Reputation points

2021-09-01T06:35:57.3+00:00

You mean that calling the /bookingBusinesses/{id} endpoint with the same token on different tools will get different results, right?
Soni, Prashant 1 Reputation point

2021-09-01T09:47:00.517+00:00

i, @CarlZhao-MSFT we found 200 OK responses with the right result on the online testing tools mentioned with the same token.

Further, looking into the issue, we found if we set the user-agent to "Mozilla" it works however it does not work with any other user-agent.
CarlZhao-MSFT 44,666 Reputation points

2021-09-02T10:07:51.343+00:00

Essentially, the two tokens are not much different, they are both ms graph api tokens, and they have the same aud (00000003-0000-0000-c000-000000000000 and https://graph.microsoft.com are the same ) and scp. The only difference between them is that they are obtained in different ways. 00000003-0000-0000-c000-000000000000 is the token for the 1.0 endpoint, and https://graph.microsoft.com is the token for the 2.0 endpoint, so your question is that the token of the 2.0 endpoint does not work in the console app, deployed Azure API app, azure function, CURL, Postman?
Soni, Prashant 1 Reputation point

2021-09-02T11:39:28.783+00:00

Yes, that is right. Also, strangely same token works if the user-agent is set to Mozilla. does it have anything to do with tenant setup (like MFA, hybrid) and how is it working only with moziilla user agent?
CarlZhao-MSFT 44,666 Reputation points

2021-09-03T10:14:14.473+00:00

You mean that if the user agent is set to Mozilla, both tokens will work?
Soni, Prashant 1 Reputation point

2021-09-03T10:15:41.57+00:00

Yes that is right.
CarlZhao-MSFT 44,666 Reputation points

2021-09-03T10:17:45.013+00:00

Ok, I will study it in depth, please wait for my news.

Share via

Bookings API By ID, returns 403 in postman, curl and custom apps, works fine on online API test tool

Your answer