MYOB Essentials Invoice API unable to push invoice

Question

I am using RestSharp to push an invoice to MYOB.

RestClient myobPostInvoicesClient = new RestClient("https://api.myob.com/");                   
RestRequest myobPostInvoicesRequest = new RestRequest("au/essentials/businesses/" + business_uid + "/sale/invoices", Method.POST);
myobPostInvoicesRequest.AddHeader("Authorization", "Bearer " + access_token);
myobPostInvoicesRequest.AddHeader("x-myobapi-key", clientId);
myobPostInvoicesRequest.AddHeader("x-myobapi-version", "v0");
myobPostInvoicesRequest.AddHeader("Content-Type", "application/json");

The JSON I am sending to the endpoint is as below

{{
  "contact": {
    "uid": "26939970"
  },
  "invoiceNumber": "IV00000000082",
  "issueDate": "2020-06-07T09:00:00",
  "dueDate": "2020-07-07T09:00:00",
  "gstInclusive": "true",
  "status": "Open",
  "lines": [
    {
      "unitOfMeasure": "Qty",
      "quantity": 5.0,
      "unitPrice": 1000.0,
      "total": 5000.0,
      "taxType": {
        "uid": "10"
      },
      "account": {
        "uid": "9"
      },
      "description": "Test Description"
    }
  ]
}}

The Response I am getting back from the MYOB Invoice API endpoint is

"{\"errors\":[{\"field\":\"\",\"message\":\"Forbidden\",\"code\":\"403\"}]}"

The access token and client id are both valid and I am following the structure of the Invoice based on the below link

https://developer.myob.com/api/essentials-accounting/endpoints/sale/invoices/

The ones I have included in the request where the fields that were previously marked as required but MYOB have modified the UI.

Just for reference I can GET contacts, accounts and taxtypes from MYOB, just getting the Forbidden 403 message back trying to POST an Invoice.

Any help you could provide would be very much appreciated.

Answer 1

If you are getting 403 Forbidden, you need to check the permissions on the account that you are using to make the post call.

See here to read about the permissions of the account

Except from link above

How do I check a user's access permissions

To find out exactly what rights the current user has, and to ensure they have the right permissions for your application to function correctly make a GET request to the {{company_file_uri}}/{{company_file_id}}/CurrentUser endpoint.

Following response tells you what permissions the user has on each url

{
    "UserAccess": [
        {
            "ResourcePath": "https://{{company_file_uri}}/{{company_file_id}}/Banking/BankAccount/",
            "Access": [
                "GET"
            ]
        },
        {
            "ResourcePath": "https://{{company_file_uri}}/{{company_file_id}}/Banking/ReceiveMoneyTxn/",
            "Access": [
                "GET",
                "POST",
                "PUT",
                "DELETE"
            ]
        },
      ...
    ]
}