I've tried everything! Warning: You do not have permission to access the API!

I've RTFF and tried everything without solving the problem. Anybody has any idea how to solve the problem? Thanks!

I enter in sales and look at an order. I change the orderstatus to shipped. The I click add to history and I get the message:
Warning: You do not have permission to access the API!

Normally I can edit 2 orders without problems and then this problem occurs. I have to logout and login to be able to change the orderstatus.

What I've done is:
* In Admin CP > System > Users > User Groups > Administrator [edit] > I already have select all Access and Permissions.
* In Systems > Users > API > Ip adresses I have my IP no.
* System -> Settings -> Option -> API User. Default chosen.

While you are on order list for first time after logging in and Your ip address was changed since last login. Then you should see Add ip button message in header. So once you click add ip button the error shall not come.

Or you can download Disable API Checks extension from this page and forget about this pain. Just note, that your API will become a bit vulnerable. But if you're now owner of Amazon or Ali, this won't matter much.

imdevlper18 wrote: ↑

Tue May 02, 2017 5:19 pm

While you are on order list for first time after logging in and Your ip address was changed since last login. Then you should see Add ip button message in header. So once you click add ip button the error shall not come.

It doesn't seem that my Ip changed. There is no Add ip button message in header. The IP I use is already listed in System/API/API username/Default/IP addresses.

You haven't listed your OpenCart version.

Boppe wrote: ↑

Tue May 02, 2017 6:40 pm

It doesn't seem that my Ip changed. There is no Add ip button message in header. The IP I use is already listed in System/API/API username/Default/IP addresses.

Then your error is that internally while api is getting called it is getting failed.

The major reason for this has been http and https.
So consider an order is made on your site and order url is saved as https.
And your admin side is non https. So this shall fail.
And vice versa is also true.

You can tell your opencart version so fix can be tried.

paulfeakins wrote: ↑

Tue May 02, 2017 6:57 pm

You haven't listed your OpenCart version.

Sorry, OC 2.3.0.2.

is your front end https or http ?
And is your admin side https or http ?

imdevlper18 wrote: ↑

Tue May 02, 2017 9:15 pm

is your front end https or http ?
And is your admin side https or http ?

Both use http.
In settings > server it's set not to use SSL.

Okay. It is not possible to know the actual cause of error unless it is checked.
You can email us at support@cartbinder.com

In Settings>Server am I supposed to enable Use SSL even though I don't use https?

All you bright guys and girls, any suggestion for a solution?

Boppe wrote: ↑

Wed May 03, 2017 2:24 am

All you bright guys and girls, any suggestion for a solution?

Have you even read a replies? Please, do so.

imdevlper18 wrote: ↑

Tue May 02, 2017 10:37 pm

Okay. It is not possible to know the actual cause of error unless it is checked.
You can email us at support@cartbinder.com

I tried enabling SSL in Settings > Server. I still got the same error message: Warning: You do not have permission to access the API!

thekrotek wrote: ↑

Wed May 03, 2017 2:39 am

Have you even read a replies? Please, do so.

Strange question, but yes I've done so. Regarding your suggestion to download your extension doesn't sound wise, as you point out that it will make my API vulnerable.

As no working solution was given I still wonder if somebody has a suggestion how to solve the problem?

I had a similar problem with a certain web host, switching web host fixed the problem for one of my clients.

Not saying this is the answer for you, but this particular cloud host seemed to be the reason

The host in question was Vidahost (TSO Host)

Boppe wrote: ↑

Wed May 03, 2017 1:40 pm

Strange question, but yes I've done so. Regarding your suggestion to download your extension doesn't sound wise, as you point out that it will make my API vulnerable.

As no working solution was given I still wonder if somebody has a suggestion how to solve the problem?

I pointed out, yes. But do you know, what I meant? Do you know, which kind of vulnerability I was talking about? If you're not a developer, then I doubt you do. So why afraid then?

The issue is very well known and nobody has a generic solution. Sometimes it depends on server setup and can be fatal. You might not get any other solution at all. You can simply browse the forums and see, how many people were fighting with the same issue and didn't find any solution.

So yes, disabling API checks is a pretty much working solution. Let's just say it's a last resort.

thekrotek wrote: ↑

Wed May 03, 2017 3:35 pm

I pointed out, yes. But do you know, what I meant? Do you know, which kind of vulnerability I was talking about? If you're not a developer, then I doubt you do. So why afraid then?

Of course I'm not a developer, if I was I would propably not need to be asking how to solve this problem. No, I didn't specifically know what kind of vulnerability you were talking about. However when a developer warns about his own extension it doesn't make you want to install it. Specially when the extension is recently created and showing 0 downloads and 0 comments.

uksitebuilder wrote: ↑

Wed May 03, 2017 2:45 pm

I had a similar problem with a certain web host, switching web host fixed the problem for one of my clients.

I'm quite satisfied with my current web host and rather not change web host just to try to correct this error message. Thanks anyway.

Boppe wrote: ↑

Wed May 03, 2017 3:51 pm

Of course I'm not a developer, if I was I would propably not need to be asking how to solve this problem. No, I didn't specifically know what kind of vulnerability you were talking about.

Every manual for every medicine warns you about possible complications. Every doctor MUST warn you about all possible complications. If it stopped you from taking the medicine, you'd be not very much alive already. So consider me as a software doctor.

In short, warnings are to be aware of, not to be afraid of. Kinda huge difference, if you ask.

Boppe wrote: ↑

Wed May 03, 2017 3:51 pm

However when a developer warns about his own extension it doesn't make you want to install it. Specially when the extension is recently created and showing 0 downloads and 0 comments.

Number of downloads and comments means absolutely nothing. Especially considering, that the whole Marketplace is broken and counts these numbers pretty bad. If any.

In this situation, especially being a non-developer, you could simply ask me about vulnerabilities I mentioned, not argue with me. I know what I'm talking about and you're just guessing. But hey, that's your life, your store. I already told you, which kind of issue you're currently experiencing and how to solve this in a blunt way. It's up to you to use this information any way you like.

Still trying to get rid of the message:
" Warning: You do not have permission to access the API!"

I've tried, without success, the following:
*************************************************
System > User > API
1 Created API Example : " Main IP "
2 Click on Generate API
3 Make it Enable
Click on API Addressees
Click on ADD IP
Copy paste your IP
Click on Save

System > Setting > Edit Your main Store > Click on Option tab
API User
Select " main IP "
*************************************************
This solution seems to be the most recommended solution, but it only works for some.

Any bright ideas how to solve it?

I just noticed something about the message that shows up when updating order history: Warning: You do not have permission to access the API!

The message turns up when using Firefox or Microsoft Edge. However, the message doesn't show when I tried with Internet Explorer 11.
Any explanations to this?