# Can't access documents from AmazonS3 server

**URL:** <http://forum.companieshouse.gov.uk/t/cant-access-documents-from-amazons3-server/1871>\
**Category:** API Issues\
**Created:** [June 20, 2018, 11:31am UTC](http://forum.companieshouse.gov.uk/t/cant-access-documents-from-amazons3-server/1871 "2018-06-20T11:31:00Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![voracityemail](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/v/b77776/32.png) [@voracityemail](http://forum.companieshouse.gov.uk/u/voracityemail)\
**Post date:** [June 27, 2018, 9:36am UTC](http://forum.companieshouse.gov.uk/t/cant-access-documents-from-amazons3-server/1871/2 "2018-06-27T09:36:13Z")

</div>

You’re almost there. As it says in [the thread you mentioned](http://forum.aws.chdev.org/t/document-images/26/21?u=kasia_kulma):

> [@Document Images](http://ec2-34-244-67-204.eu-west-1.compute.amazonaws.com/t/document-images/26/22):
>
> This still looks like an authorization error, both the original Authorization header for the Document API and the Signature query string parameter are present in the request to Amazon S3.
> 
> Even with redirects disabled, you need to make sure you’re not reusing the original request to the Document API when requesting the actual resource from S3 - or at the least, remove the Authorization header from the original request before reusing it.

So your final request:

```
final_test <- GET(final_url, 
             add_headers(Authorization = decoded_auth,
                         Accept = accept
                         ))

```

… should be like:

```
final_test <- GET(final_url,
             add_headers(Accept = accept
                        ))

```

(Apologies for formatting - I don’t speak R).

Amazon require authentication but all their authentication is done via the contents of the “final\_url” e.g. the authentication is passed as parameters in the query string. So if you also include the http headers for authorisation from Companies House (the “Authorization = decoded\_auth” ), this will confuse the Amazon servers.

You can check this by looking at the response you got back: (this is what’s being returned with Content-Type: application/xml in your last example). It will be something like:

```
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidArgument</Code>
<Message>Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter,
Signature query string parameter or the Authorization header should be specified</Message>
<ArgumentName>Authorization</ArgumentName>
<ArgumentValue>Basic {your api key would be here}</ArgumentValue>
<RequestId>{blah}</RequestId>
<HostId>{long hostid string}</HostId></Error>

```

Again, check - among all the stuff in the final amazon URL you get in the http redirect (302) from Companies House you’ll see e.g.:

```
AWSAccessKeyId={their access key}&Expires={token expiry time}
&Signature={signature}&x-amz-security-token={very long security token}

```

So just omit the CH Authorisation header at the last step and you should be fine.

Here’s (yet another) plug for the [free cUrl library / command line utility](https://curl.haxx.se/) for diagnosing these issues / investigating REST interfaces. Although it’s old and there are more specialised tools (one I’ve used is [SOAPui](https://www.soapui.org/)) it’s fast and simple. For info the most useful cUrl switches here are:

- Send username (and optionally password): -u_USERNAME_:_PASSWORD_ or --user _U_:_P_
- Show http headers: -I or --head
- Dump http headers to a file: -D _filename_ or --dump-header _filename_
- Add a header line (e.g. Accept: _content-type_): -H _headerline_ or --header _headerline_
- Automatically follow redirects: -L or --location

Don’t forget to quote URLs, header lines etc. In particular, unquoted URL characters like “&” will cause problems in most shells / command line environments…

---

_[View the full topic](http://forum.companieshouse.gov.uk/t/cant-access-documents-from-amazons3-server/1871)._