I am an experienced RESTful developer, years of experience developing MTD products but new to CH platform. Everything looks straightforward until you start getting 403 for no apparent reason.
I have recently signed up, created an app, generated keys, configured redirect urls localhost and ports. Any calls coming back with 403. Cannot create a test company so nothing testing.
Any wise words?
Can you try this:
curl -v -u 'YOUR_API_KEY:' \
https://api.company-information.service.gov.uk/company/00000006
And if it fails, can you post the 403 body with the key redacted and maybe that might reveal more.
Additionally:
Have a gander at this and see if it’s relevant to you: Issues with creating test company in sandbox API
And this: Reports of invalid auth when using key in test.
GET /company/00000006 HTTP/1.1
Host: api-sandbox.c…gov.uk
User-Agent: curl/8.21.0
Accept: /
Authorization: Basic tMWIzYi00NTAxLWE5YjktNGY
Help appreciated
You originally mentioned you wanted to create a new test company, the header/response you posted mentions http://api-sandbox.company-information.service.gov but the CH docs [Different URI for create] state POST https://test-data-sandbox.company-information.service.gov.uk/test-data/company should be used, have you tried this URI yet?
Yes I have. Still getting ‘Forbidden’. Is it just the 2 APIkeys : test and live or there are some other keys one requires?
There are three client credential types, not just “test and live keys”:
However, you only need a TEST REST API KEY to create a test company in the sandbox.
I’ve just tested this myself today using a Test application API key and the endpoint is working.
This exact request returned HTTP/2 201 Created:
curl -v \
-u 'MY-TEST-APPLICATION-API-KEY-HERE-FOLLOWED-BY-A-COLON:' \
-H 'Content-Type: application/json' \
-d '{}' \
'https://test-data-sandbox.company-information.service.gov.uk/test-data/company'
So I think we can rule out the Test Data Generator endpoint itself.
I’d now concentrate on the credential. In Developer Hub, make sure you have:
Application: Test
Client type: API key
rather than a Live API key, Stream key, OAuth client ID or OAuth client secret. This is a screenshot of the test application page where I got my API key from to perform this test:
Also check whether the API key has an IP restriction configured. For diagnosis I’d create a new Test API key with no IP restriction and try exactly the command above.
You don’t need OAuth or your localhost redirect URLs for this particular request, the Test Data Generator authenticates using the Test API key.
If a newly-created unrestricted Test API key (give it 5 minutes to propagate) still produces a bare 403, I’d send Companies House support the timestamp and request details because the identical request is currently returning 201 for another Test application.
This is the output from the CURL statement above, it shows a HTTP/2 201 response, identifies x-ratelimit-remain: 599 because this was my first test against the API during the last 5 minutes.
Thank you for being patient 
It was the restriction on the ip address. I have removed it for now as my focus is to write code that works in the first place.
I’m glad you made progress with it 
