DavidDNCS , there is no other option, to authorise file access you must be a file admin. Your client can give you that role temporarily, and even make your file access read-only until authorisation is complete. (The authorisation from your app will still work).
That error message could also relate to an invalid redirect. There are much stricter rules about redirects now, as the API support write to me:
“validation of the redirect URI has been tightened. As a result, non-HTTPS, localhost-style, or internal hostnames (like http://desktop) may now be rejected during the final redirect step after consent. When that happens, it surfaces as a generic “unable to connect, something went wrong” message, which is what you were seeing”. (This strict application was not notified.
Thanks for this info, I am one more step along the way. I believe it was my http://desktop redirect URL that was the stumbling block, and changing it to https://desktop in my registration and in my code got me connected, I think. However I now have another problem: the code I get back in the businessID field is just a string. Where I make a call to the API in my .NET SDK code, I specify the company file as a CompanyFile object, as required. I can't see any variation on the call to specify the Company File as a string or a URI. Neither can I see any way to create a CompanyFile object from the string or a URI. In the past I have used the API to request a list of available Company Files and I get back a list. If there's only one I would just connect to it, otherwise I would show a dialog and let the user select. But this is all done at the MYOB end now, so it is not clear to me how to use this businessID in my .NET SDK code. If I try to use it, or a Uri created from it, in place of the CompanyFile object I have been obtaining up to now, the code will not even compile. The documentation on developer.myob.com still describes these Company File mechanisms and does not appear to have been updated for the granular scopes changes.
After spending more time on this it is even less clear. If, as stated above, the CompanyFile endpoint will be disappearing, will there even be CompanyFile objects in the .NET SDK? If not then then the SDK will need changes to all the calls that request data. If there will still be a CompanyFile object, there will need to be a way to derive one from the businessId that is returned by the new control flow. I've seen nothing about any changes to the SDK, I am using the latest version and its last change was about a year ago. What am I missing here?
Hi MarshallArts , have a look at the authorisation guide (V2) here:
MYOB OAuth2.0 Authentication Guide – Support for the MYOB family of SME product APIs
It addresses the business ID question; this is (or should be) contained in the redirect response. If it isn't, then your redirect may still be invalid. (We had to do a lot more than add an 's'!).
The guide's example redirect response is:
https://yourapp.com/redirect? code=...&scope=...&state=... &businessId=5d4b1ce0-bb9f-4f4c-9578-2b168b7295db &businessName=MYOB+Shared+Sandbox+21
The businessID takes the place of the company file uri (abbreviated to cf_uri in the documentation). I've not used the SDK, someone else may be able to advise you.
I had it working a couple of weeks ago having changed to https//desktop (my apps are desktop not online)and added all the scope stuff and it all worked for a while. FOr some of my test files it still works but I get the “unable to connect, something went wrong” for one of my files. My end users have their own files which are one of my business so the app hass to show them an authentication form and let them log in and pick their own file.
The problem is that things are being changed continuously with warning. For example the process now involves opening a browser page on the way through, both for access AR itself and for authorisation. That appeared without warning or explanation a few eeks ago and makes it hard to trust the whole process. if something else changed is that what broke it?
There should be no such changes without adequate warnings to both users and developers.
I am left with the impression of some developers coding on the fly on the live system rather that developing a final working version on a parallel platform, then advising everyone how it is going to work in advance of implementation, well in advance for developers to have time to catch up.
I puzzled over this at first but the way it works is that you select a file, as an admin user and get a code which enables you to get a token & refreshtoken specific to your file. Then you can do a GET specific to your file which gets you the CompanyFile end point record for just that file, with all the same fields but only one record.
