1

I am attempting to use the GoCardless API sandbox to create a customer but only get a 403 forbidden error

  {"error": {
   "message": "Forbidden request",
   "errors": [   {
      "reason": "forbidden",
      "message": "Forbidden request"
   }],
   "documentation_url": "https://developer.gocardless.com/api-reference#forbidden",
   "type": "invalid_api_usage",
   "request_id": "8b870491-e8ca-436c-a602-bb613bba7d96",
   "code": 403
}}

I have used OAuth to get a bearer token which I am using for my post to the sandbox url

https://api-sandbox.gocardless.com/customers

Using this url and the bearer token i can get customers and update a customer that i created manually via the sandbox client portal. If i purposefully make the token an invalid value i get a 401 error instead so I am sure the token is correct.

The documentation for the error type "invalid_api_usage" is as follows

This is an error with the request you made. It could be an invalid URL, the authentication header could be missing, invalid, or grant insufficient permissions, you may have reached your rate limit, or the syntax of your request could be incorrect. The errors will give more detail of the specific issue.

The fact i can update a customer i believe crosses most of those potential issues of that list.

I am now using the exact post body content of the GoCardless API example for creating customer to verify the syntax should be correct.

{
  "customers": {
    "email": "user@example.com",
    "given_name": "Frank",
    "family_name": "Osborne",
    "address_line1": "27 Acer Road",
    "address_line2": "Apt 2",
    "city": "London",
    "postal_code": "E8 3GX",
    "country_code": "GB",
    "metadata": {
      "salesforce_id": "ABCD1234"
    }
  }
}

I am running these requests from SoapUI instead of my application so I can be sure I am sending exactly what i am expecting to send.

From the API documentation I understand my application must have approved payment pages to create customers in the live environment however this is prefixed by a statement that this is not restricted in the sandbox environment.

Restrictions

Whilst the entire GoCardless API is accessible in the sandbox environment, the following restrictions exist in live.

Payment page restrictions

Unless your payment pages have been approved as scheme rules compliant by our sponsor bank you must use the Redirect Flow API to create customers, bank accounts and mandates.

The following endpoints are therefore restricted:

  • Customers: Create
  • Customer bank accounts: Create
  • Mandate: Create, Reinstate
  • Javascript flow: All endpoints

It seems to me the 403 forbidden response is exactly what i would be getting if Create Customer was restricted in the sandbox environment however the API documentation explicitly states that this is not the case.

My question is basically what could I be doing wrong? Maybe somebody can spot something I have forgotten or am misunderstanding.

ignition22
  • 11
  • 2

1 Answers1

0

The answer is that the sandbox is restricted in the same way as the live environment.

The API documentation appears to be worded in a way that suggest the sandbox is unrestricted however this is not the case.

To remove the restriction in the sandbox environment you need to contact GoCardless support and request it.

ignition22
  • 11
  • 2