Api calls with user account and 2FA enabled

,
1

Hi,
Our internal management tools interacts with Shotgrid to create/update/delete different entities. For that purpose, we use a script account and an api key, that works fine.

We also need to be able to enable/disable HumanUser accounts.

For now (before enabling the 2FA), we used a HumanUser account with an auth_token (PAT generated in the autodesk account management and configured in the Shotgrid account) and managed that case through the Rest api.

1- By getting an access_token

import requests

payload = {'username': 'myuser', 'password': 'mypassword', 'auth_token': '123456789123456789', 'grant_type': 'password'}

token_end_point_url = "https://myshotgunurl.com/api/v1/auth/access_token"
request = requests.post(token_endpoint_url, data=payload)
access_token = request.json()["access_token"]

2 - Running the action on the HumanUser entity

headers = {"Authorization": "Bearer {}".format(access_token)}
sg_user_id = 1
url = "https://myshotgunurl.com/api/v1/entity/human_users/" + sg_user_id
requests.put(url, json={"sg_status_list": new_status}, headers=headers)

But since we migrated to 2FA it doesn’t work anymore.
In the first phase, we get the following error

{'errors': [{'id': 'cb4506fd97b9e97f3deeaaf361f45034', 'status': 400, 'code': 102, 'title': "Can't authenticate user 'myuser'.", 'source': {}, 'detail': None, 'meta': None}]}

Is it still possible to access the api as a humanuser in a background script ?
If not, how can we disable/enable users from background running applications ?

Thanks in advance
Best regards
Gaston

2 Likes