Basic API Key authentication not working with URLExecute

Question

I am a newbie with RESTful APIs and have never tried accessing one from inside Mathematica. I am trying to access the Companies House API, in the UK. The following command works fine from the Terminal command line (company number 00000006 is just a number a picked at random):

curl -X GET -u My_API_Key: https://api.companieshouse.gov.uk/company/{00000006}

I entered the following code in a Mathematica notebook, following the help example:

urlRoot = "https://api.companieshouse.gov.uk/company/";
company = "{00000006}";
myKey = "My_API_Key";
requestURI = URLBuild[{urlRoot, myKey, company}]

with my actual key in place of My_API_Key. The URI created is this:

https://api.companieshouse.gov.uk/company/My_API_Key/%7B00000006%7D

When I execute this command:

response = URLExecute[requestURI, "RawJSON"]

I get the dialog into which I enter My_API_Key and some blank spaces for the password. That's because the API documentation says to do this, or at least this is what I have understood. The result is this:

<|"error" -> "Empty Authorization header", "type" -> "ch:service"|>

What am I doing wrong? Very sorry if this is a really simple/dumb question, I have never tried doing this before... Thanks

Answer 1

We will generate our own Authorization header, because this API uses a slightly obtuse method. The API uses what's known as "Basic Authentication", which is essentially "Basic " + Base64["username:password"]. Since the password doesn't appear to matter for this API, we can generate our header like so.

auth = StringJoin["Basic ", 
  ExportString["MYKEY:", "Base64"]]

It's important to leave the : in place when you paste in your key.

And now we can read the results from the API:

URLExecute[
 HTTPRequest[
  "https://api.companieshouse.gov.uk/company/00000006", <|
   "Headers" -> {"Authorization" -> auth}|>]]

There are some weirdnesses here that caused your issue. First, the API uses basic authentication strangely. Normally for an API, you would pass an Authorization header with just your API key, rather than needing to encode it like a basic authentication header. As well, it seems like WL has some vaguely-defined behaviour with basic authentication. The Authorization symbol exists (as does that dialog that you came up against), but I actually can't make it work correctly. Seems like there's a bug in the system here - and if nothing else, it's poorly documented.