You do not have a sufficient priv level to access this resource

[Rob Gething]

I'm trying to create a Power Automate flow that'll receive a JSON array via a HTTP request, create a CSV table from the array and create a file in OneDrive.

I want to take the file that's been created in OneDrive and upload it to the session folder it DAV and then attach the uploaded file to a request.

When I try to do a HTTP PUT request, I get an error with a 403 status code saying "You do not have a sufficient priv level to access this resource".

I am using https://mdh-p01-api.hornbill.com/iposervicedesk/dav/session/2023-09-08T08_42_12.9974088Z.csv as the URL and using an API key that has been generated under the system admin account, so access shouldn't be an issue.

This was originally working about 11am yesterday morning, but was uploading blank files and attaching them to the request, it has since stopped working and is failing at this step.

If I use POST rather than PUT, a 404 HTTP status code is returned.

[Gerry]

@Rob Gething

Without trawling the change logs/source code, I wonder if there is something here in relation to the fact the API key is created on the admin account.  The admin account is treated differently in quite a lot of ways, so as a potential suggestion, I would create an API key on a non admin account (your own for example) who can upload files, and then try your integration with that key and see if you get the same problem. 

Also, if you are putting content up on the session folder, PUT is what you should be using, so that seems right, its just a permissions issue. 

Gerry

[Steve G]

Hi @Rob Gething,

We've found and fixed the issue, this will be in a platform update during the usual release cycle so please keep an eye on the announcements forum for it appearing in the release notes.

As a workaround through, before you attempt to do the PUT, have your script make a call to one of the Hornbill service APIs to properly generate a session using the API key to ensure that the dav/session endpoint is available. I'd recommend calling the session:getSessionInfo API, and just disregard the response before performing the PUT request.

Cheers,

Steve