Here Maps - cannot authorize to Maps Feedback API

Question

Here Maps provide Maps Feedback API for i.e. submit information about missing places on their maps. I created a project and generate API Key which I used for Places API with success. Next, I tried to use it with Feedback API, but it failed. Oddly enough without any credentials I got 200 OK.

My requests:

1. Without any APP_ID or KEY in Headers

curl --location --request POST 'https://maphub.api.here.com/feedback/' \
--header 'Content-Type: application/vnd.here.layerObjectList+json; charset=UTF-8' \
--header 'Accept-Charset: charset=UTF-8' \
--header 'Auth-Service-Id: here_app' \
--header 'Group-Id: FGx1AWaAzKOo0imNkLmf' \
--data-raw MY_DATA

response: 200 OK with body containing id of feedback (important for checking status).

2. Like above but for maphub.cit.api.here.com instead of maphub.api.here.com

response: 401 Unauthorized: Authentication failed. Reason: Missing authentication credentials

3. With APP_ID and API_KEY

curl --location --request POST 'https://maphub.api.here.com/feedback/' \
--header 'Content-Type: application/vnd.here.layerObjectList+json; charset=UTF-8' \
--header 'Auth-Identifier: MY_APP_ID' \
--header 'Auth-Secret: MY_API_KEY' \
--header 'Group-Id: FGx1AWaAzKOo0imNkLmf' \
--header 'Auth-Service-Id: here_app' \
--data-raw MY_DATA

response: 401 Unauthorized: Authentication for app_id MY_APP_ID FAILED (wrong app_code provided).

I the dashboard I don't have any app_code so I put in Auth-Secret my API_KEY.

4. Feedback status without any headers

curl --location --request GET 'https://maphub.api.here.com/feedback/ID_FROM_FIRST_REQUEST' 

response: 403 Forbidden

How I can correctly authorize to Here Maps Feedback API? For me it's important to send feedback and then check its status.

Manhunt

Have you checked example curl request at developer.here.com/documentation/examples/rest/map_feedback ? Is it possible that cit domain works only without authorization or with those test credentials (not with your production ones)? – Artair

Yes, example curl request for both domains (maphub.api.here.com and maphub.cit.api.here.com) returns 200. When I removed auth headers only for main domain was ok (for cit was 401 - like above). cit domain is for testing purposes. – Manhunt

Answer 1

The REST endpoints *.api.here.com expect APP_ID and APP_CODE credentials.

However, APP_ID and APP_CODE credentials have been deprecated in December 2019 in favor of the API Key (which relates to an APP_ID, but the latter is not sent anymore in the request).

I assume you created your developer account project after the change, which is why you have no possibility to create the legacy APP_ID and APP_CODE pair for REST services.

Normally, REST services now offer a new endpoint in *.hereapi.com precisely for authentication with API Key, while still offering the legacy endpoint *.api.here.com for compatibility reason.

The problem is, I do not see the new endpoint for the Map Feedback API. It does not seem to exist. This is why I'd suggest to contact [email protected], by mentioning the issue, and that you therefore need an APP_CODE for your generated APP_ID.

Older accounts have the following section:

Futhark

Thank you for your information. Yes, I created an account about a month ago. I wrote to support a few days ago and I'm still waiting for a response and some hints on how to access. So contact support is the only way to get access? – Manhunt

Normally you shouldn't have to contact support to get access, as all REST API should provide an endpoint that accepts the new method of authentication, namely, API key instead of the pair app_id and app_code. But obviously Map Feedback API is lacking behind, so you found an issue here. Also I think the old authentication method shouldn't have been removed from the newly created Dev accounts, before making sure all APIs have been updated. – Futhark

Ok, thanks a lot. I have just received a new APP_ID and APP_CODE from support. Seems to be ok. – Manhunt

You're welcome. Hopefully Map Feedback API will also provide an endpoint accepting API keys. – Futhark

For any follow-ups: app_code has been deprecated in favor of bearer tokens. See here: developer.here.com/documentation/identity-access-management/… – Treehopper