CiviCRM Community Forums (archive)

Hi,

On 2.1, I'm trying to use the rest interface.

I can authenticate and get a key
http://www.example.org/path/to/civi/codebase/civicrm/extern/rest.php?q=civicrm/login&name=user&pass=password

But on the second step, I get an error message:
[error_message] => session keys do not match, please re-auth

http://www.example.org/path/to/civi/codebase/civicrm/extern/rest.php?q=civicrm/contact/search&key=62c1b4c363d4f8b9815d9d573f4b6100552a7ad6&return.first_name=1&return.email=1

That doesn't work from a php client (using simplexml_load_file) but does from the browser.

I assume that's because the session is empty on the second call. What is the proper way ? shall I use curl to go through that ?

(I'm using that "documentation" btw http://civicrm.org/node/412 )
 

Hi,

Yes, where I ended up indeed.

Any specific reason not to return the session ID, and allowing it to be sent as a get param instead of a cookie ? Would make it easier and more readable on the client front.

Also is it possible to have a json return instead of a ResultSet tag ?

X+

Ok, it seems that the only extra param is PHPSESSID

Suggested change on the API:

1) It can either accept a couple PHPSESSID+key or the login+pwd
Rationale: when you have only one list of contact to grab, no need to have to requests (login+contact/search)
The session ID is better otherwise.
(the password still is in clear on the wire, as an evolution, offer an api with challenge/response ?)

2) Return a constant error_id on the top of is_error=1 and the error message.
Rationale: easier to parse and act differently (eg if the error if session expired, then reauthenticate

X+