Run a job through API error

[albert_alaluf]

Hello community,

I have an issue not able to figure it out how to fix.

My user has a workflow, published to the gallery, and used her credentials when publishing. When she runs, she writes the output to a network folder, it works.

She wants to automate the process, so she doesn't want to schedule the workflow on the server. Whatever the other external process was completed, it triggers and calls the workflow through the API. API runs the workflow, but it fails to write output to a network folder.

When we compare the workflow results, we found that, in the first scenario, running directly form the gallery, gallery use her credentials. But API scenario, it shows that the workflow ran in the gallery as local user. This shouldn't be the case, because when she published the workflow to the server, she provided her credentials. Even it's used 'Always use that credentials' option, no success.

Any suggestion how to fix it?

[geraldo]

@albert_alaluf 

What I can say is that in the designer, if everything is in the folder where the workflow is saved, there will be no error.
In the gallery on the server everything has to give the UNC address \\server\folder\file
if in this configuration you need a file, you will have to inform the entire path and the server service user will have to have access to this folder.
%Temp%arquivo.ext can be used when generating and using files on the server or in the gallery

[Gaurav_Dhama_]

To call the api, you need to have the token created, can you check if the credentials are correct to generate the token?

if she had no issues running the flow in gallery, her credentials shouldn’t ideally cause any issue through API as well.

[albert_alaluf]

@geraldo @Gaurav_Dhama_ Thank you for your feedback. I made more search and I found that I would need to create credentials on the server to use with server API v2 with the credentials I created. That worked. However now I have another challenge and looks like I need to request as an idea. Only the Curator can save the credentials, not even the Artisans as much as I know. I'm the Curator and I can't ask to user to share their credentials with me to save the gallery. I tested the server API V3, I saved my credentials, I used my credential id, and run a sample workflow which I confirmed that the job ran as with with user name. 

If rephrase what I want to do is to run a job with an API by workflow owner, not as a local user.

[geraldo]

@albert_alaluf 

As far as I know, the Alteryx server will always run the api with the token and secret by the service user that is added in the Alteryx configuration controller even when running through the Gallery or API and access to network folders must also be given to read and recording files as well as database access. The user can see all the workflows that are in the same private studio and when he executes he can only see the jobs executed by him but even so he is executing he is the ALteryx server service user

[albert_alaluf]

Yes, you're right @geraldo , we didn't add service user, but local user. However the user doesn't like to give access to any users except their group which they are running critical and sensitive data. So if they run the workflow through the gallery all works fine. However they like to automate. When they run another internal/external process on their end and when it is completed, it will trigger Alteryx job that why we need to run through API and by the person who owns the workflow. Any service account is out of equation at the moment. Also as much as I know, service accounts has no access to any network folders. If they can, this might be a solution. I will test this.

[geraldo]

@albert_alaluf 

is what I'm saying. If the user has artisan in his configuration and given permission to execute API in the user configuration, I don't see that there are problems. he just puts his token and secret key credentials with permission to run the api he will run his flow normally. Question: Are these users allowed to execute API?

[albert_alaluf]

Yes, they are given the permission to execute API. This is being done by executing Server API v3, post a job. If you don't provide the credentials, it will create and execute a job as a local user (server) which it doesn't have an access to network folders. If you create a credential on the server, and execute a job by adding this credential on API, and execute it, it will run as the user you provided in credential. The problem is I should ask the user's username and password to create the credential, which is against company policy. Is there any way to add a credential to the gallery without compromising username/password?

[Gaurav_Dhama_]

You can hard code the the credentials of the owner of the workflow to generate token then use it irrespective of who is running it. I have tested it in my end.

Another method is you can have a service account credential being used to generate the token, but yes this service account will have to have all the access.

[albert_alaluf]

@Gaurav_Dhama_ I'm not sure for the second option, but the first one looks like promising. How to get user credential id if it is not created on the gallery? I was looking for that option, and APIs provide credential id if it is created only in credentials.

This is only available in v3 APIs.

AppValuesV2 {

credentialId (string, optional),

questions (Array[AppValue], optional),

priority (string, optional)

}
AppValue {

name (string, optional),

value (string, optional)

}