Load an a360 model without user auth

[Anonymous]

I would like to serve different models from my a360 depending on parameters, but without any kind of auth from the user. Is it possible to achieve this at the moment?

I want to render a model from my a360 bucket and I've read that if I want to use the Data Management API I need to use 3-legged auth.
However, I want the user to see that model, which is in my a360, but I don't want the user to have access to my account or even have an account.

[philippe.leefsma]

The 3-legged oauth authorization mechanism is designed to let your application (an application in general) access resources from a specific user account once it has been authorized through a web page.

In your case you want to serve data from your account to other users of your app, so what you would need to do is first get a valid auth token for your account, you can hardcode it in your server, then your application will refresh this token "forever" based on its expiracy period so it remains authorized.

Once you have a valid token (with full privileges - if needed), you can request a downgraded token (a token with limited scope, e.g only for data:read) which can be sent to a client app in the browser so it will be allowed to load that model from your account. Users will not be able to perform any other create/write operations on your account if they grab that token, however they could load any model may they know their URN's.

You can take a look at my sample there, which implement downgrade scope logic to pass read-only token to the client.

Let us know if you have further questions

Regards,

Philippe.

[Anonymous]

Thanks Philippe. It took me a while as I didn't know I had to get a token for the acmsession to permission to access to the resource from a360.
Is this documented anywhere? I couldn't find it

[philippe.leefsma]

A360 API is a 3-legged OAuth authentication mechanism, this requires you to acquire a valid token with relevant scope based on the kind of operation you want to perform (read-only, read/write, ...) this is definitely documented at the same location than all our web APIs, the Data Management (A360) section is available there: https://developer.autodesk.com/en/docs/data/v2

[Anonymous]

Thank you Philippe,

Maybe I wasn't clear enough. I wasn't talking about the token, I mean't the call to:

https://developer.api.autodesk.com/oss-ext/v1/acmsessions

Related:

https://stackoverflow.com/questions/37835178/creating-a-viewer-application-with-an-urn-from-autodesk...

[philippe.leefsma · Accepted solution]

It is not documented because the recommended way to to translate the file again using your credentials and not use the acmsession Id, I am not sure this approach will remain valid in the future, let me check with the development team and I will get back to you.

By the way, for logging new threads, please prefer StackOverflow as we progressively migrate all our support there.

Regards,

Philippe