# urllib.error.HTTPError: HTTP Error 403: Forbidden **URL:** \ **Category:** Icinga Web\ **Tags:** icingaweb2, icinga2\ **Created:** [August 13, 2021, 11:00pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994 "2021-08-13T23:00:04Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 13, 2021, 11:00pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/1 "2021-08-13T23:00:04Z")
Hello, I am trying to obtain the disconnection and connection data in json format from icingaweb 2 (installed in debian 10) through a python code, for later it works with that data but when executing the code it gives me this error: urllib.error .HTTPError: HTTP Error 403: Forbidden, I leave you my code so that you can guide me. from urllib.request import Request, urlopen import json req = Request(‘[http://localhost/icingaweb2/monitoring/list/eventhistory?timestamp\>=-7%20days](http://localhost/icingaweb2/monitoring/list/eventhistory?timestamp%3E=-7%20days)’, headers={‘User-Agent’: ‘Mozilla/5.0’}) response = urlopen(req).read() data = json.loads(response.read()) ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 14, 2021, 2:43am UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/2 "2021-08-14T02:43:21Z")
What does your API user config look like? **Don’t forget to redact the password** Specifically, I want to see the API perms. Usually located in `/etc/icinga2/conf.d/api-users.conf` I would also verify that it’s not something silly like putting the creds in twice and mis-typing the creds to one of your calls. PS, you can format your code with triple back-ticks. See [this post](https://community.icinga.com/t/create-topics-and-master-markdown-formatting/69) for some formatting tips ---
**Author:** ![log1c](https://community.icinga.com/user_avatar/community.icinga.com/log1c/32/2071_2.png) [@log1c](https://community.icinga.com/u/log1c)\ **Post date:** [August 16, 2021, 8:20am UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/3 "2021-08-16T08:20:40Z")
As this is a request against the webinterface the API users for the core don’t come into play here. > [@maurox521](#): > > but when executing the code it gives me this error: urllib.error .HTTPError: HTTP Error 403: Forbidden There should be some form of authentication to query the eventhistory (or anything) via the webinterface, which I don’t see in your code. ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 16, 2021, 9:59am UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/4 "2021-08-16T09:59:37Z")
this is what I have configured so far in the document you mentioned: object ApiUser “director” { password = “some-password” permissions = [“_"] } object ApiUser “icingaweb2” { password = “hello:)” permissions = [“status/query”, "actions/_”, “objects/modify/_", "objects/query/_”] } ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 16, 2021, 3:13pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/5 "2021-08-16T15:13:54Z")
Oh no, redact that password! Assuming you are using the “icingaweb2” API user, you need the `events/` permission to hit this endpoint I do believe: [http://localhost/icingaweb2/monitoring/list/eventhistory?timestamp\>=-7%20days](http://localhost/icingaweb2/monitoring/list/eventhistory?timestamp%3E=-7%20days) ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 16, 2021, 3:16pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/6 "2021-08-16T15:16:57Z")
And how can I generate a new password or reset the created object so that everything is well established, I just realized that I did it wrong hehe ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 16, 2021, 3:20pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/7 "2021-08-16T15:20:01Z")
You simply just change the password string in the config file to whatever you want. Just make sure you keep it enclosed with quotes. ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 16, 2021, 3:22pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/8 "2021-08-16T15:22:07Z")
I retested my python script and I still don’t get the json data: / ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 16, 2021, 3:28pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/9 "2021-08-16T15:28:07Z")
Even with the `events/` permission? It might need a wild card like `events/*` – if that doesn’t work, we could do a quick test and assign “all permissions” (just a simple wildcard as shown below): ```auto object ApiUser “icingaweb2” { password = “thisismypassword” permissions = [“*”] } ``` If that works, great, then you can start with individual endpoint permissions, otherwise something else might be wrong (ie, typo in the creds for the api call). Oh, after adding/changing the permissions, you will want to reload the Icinga2 configs. ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 16, 2021, 3:33pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/10 "2021-08-16T15:33:35Z")
None of that works :(, and according to me the call to the api is fine, isn’t there a way to create a new root object with a new password and use it for the api? ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 16, 2021, 3:50pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/11 "2021-08-16T15:50:53Z")
Yes! In the api-users.conf file, just create a new object: ```auto object ApiUser “root” { password = “secret” permissions = [“*”] } ``` Be sure and change that password. As always, reload Icinga2 `systemctl reload icinga2` or `systemctl restart icinga2` But if you tried adding all permissions to the `icingaweb2` api user, and reloaded, and still get the error, then your creds are probably wrong in the script. Not really related, but I have a plug for the `icinga2apic` library for Python. This could help clean up the script a little and is a pretty straight forward Python3 client for Icinga2 ---
**Author:** ![log1c](https://community.icinga.com/user_avatar/community.icinga.com/log1c/32/2071_2.png) [@log1c](https://community.icinga.com/u/log1c)\ **Post date:** [August 17, 2021, 6:36am UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/12 "2021-08-17T06:36:54Z")
> [@log1c](#): > > As this is a request against the webinterface the API users for the core don’t come into play here I’ll quote myself again 😉 You are currently querying the Icinga Web 2 webinterface and not the Icinga2 Core API. So the API user doesn’t come into play here (or brutally speaking: it is useless for your scenario). Try the query with your user you log into the webinterface with (maybe the default admin `icingaadmin`?). If you instead want to run queries against the core API ([https://localhost:5665/v1/](https://localhost:5665/v1/)…), for which that user and the permissions are needed (as @steaksauce already explained): See the [API docs](https://icinga.com/docs/icinga-2/latest/doc/12-icinga2-api/) for more information and a step-by-step explanation. ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 17, 2021, 3:52pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/13 "2021-08-17T15:52:28Z")
Ooofff… It was so obvious (I thought you meant he was querying with a web user to the API), but I now notice that the URL in the request doesn’t have the API port 🤦‍♂️ ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 17, 2021, 10:15pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/15 "2021-08-17T22:15:34Z")
Friend, I am not very clear about the first thing, then how would the query (url) be with the user with whom I log in?thanks ---
**Author:** ![log1c](https://community.icinga.com/user_avatar/community.icinga.com/log1c/32/2071_2.png) [@log1c](https://community.icinga.com/u/log1c)\ **Post date:** [August 18, 2021, 6:04am UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/16 "2021-08-18T06:04:42Z")
I have never used a script to query anything from the webinterface, but the URL in the webinterface for the json ouput of the last events is ![image](https://community.icinga.com/uploads/default/original/2X/d/d44049370dbbc87b07fda0f0f7e48ba32976f818.png) ![image](https://community.icinga.com/uploads/default/original/2X/2/2de6bf0781fd79209d268abf8e147d9ddf0f9aec.png) So add a `&format=json` to your url and try again. And use your user you log into the webinterface with, not the API users. ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 18, 2021, 7:13am UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/17 "2021-08-18T07:13:42Z")
I also tried that url but it didn’t work :(, I’m thinking it’s a problem with the icinga configuration when installing it ---
**Author:** ![maurox521](https://community.icinga.com/user_avatar/community.icinga.com/maurox521/32/4313_2.png) [@maurox521](https://community.icinga.com/u/maurox521)\ **Post date:** [August 27, 2021, 10:54pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/18 "2021-08-27T22:54:20Z")
I have tried one of the url that appears in the api section of the icinga documentation and add it to my script, since I tried in different ways but I kept getting using the aforementioned error, when adding the new url below I got the error: urllib.error.URLError: \ Does anyone know what this error is due to? I read that it was related to obtaining an SSL certificate. My script: #import urllib.request, json from urllib.request import Request, urlopen url = “[https://localhost:5665/v1/objects/hosts?hosts=first-host&hosts=second-host](https://localhost:5665/v1/objects/hosts?hosts=first-host&hosts=second-host)” #response = urllib.request.urlopen(url) #data = json.loads(response.read()) #print (data) req = Request(url) data = urlopen(req).read() print (data) ---
**Author:** ![steaksauce](https://community.icinga.com/user_avatar/community.icinga.com/steaksauce/32/1831_2.png) [@steaksauce](https://community.icinga.com/u/steaksauce)\ **Post date:** [August 28, 2021, 2:51pm UTC](https://community.icinga.com/t/urllib-error-httperror-http-error-403-forbidden/7994/19 "2021-08-28T14:51:22Z")
> [@maurox521](#): > > urllib.error.URLError: \ This is a `urllib` python package error, not directly related to Icinga. You would likely encounter this making an API call to any URL that has a self-signed cert. Places like [this stack overflow post](https://stackoverflow.com/questions/35569042/ssl-certificate-verify-failed-with-python3) would be the best bet for a work around. I think the `requests` package just gives you a warning when you make a call like this – the warning shows in the output, but doesn’t prevent you from making the call. Of course, that package has it’s own ways around the warning.