DXE-4679 running akamai cps setup we are seeing errors 403

[mguentge]

When running akamai cps setup we are seeing errors 403. in credentials Contract API is set to READ-ONLY.
Can you please explain, why access is blocked?

$ akamai cps setup
Trying to get contract details from [default] section of ~/.edgerc file
Invalid API Response (403): Unable to fetch contracts
{
"type": "https://problems.luna.akamaiapis.net/-/pep-authz/deny",
"title": "Forbidden",
"status": 403,
"detail": "The client does not have the grant needed for the request",
"instance": "https://akab-******sgup.luna.akamaiapis.net/contract-api/v1/contracts/identifiers?depth=TOP",
"authzRealm": "a2xh6tg**************n77rj4h",
"method": "GET",
"serverIp": "2a02:26f0:1700:388::1f3f",
"clientIp": "2a02:908:534:2540:241b:e74f:b710:8800",
"requestId": "695f928e",
"requestTime": "2025-01-30T11:16:13Z"
}

$ http --auth-type edgegrid -a default: :"/contract-api/v2/contracts/identifiers?depth=TOP"
HTTP/1.1 403 Forbidden
Connection: keep-alive
Content-Length: 553
Content-Type: application/problem+json
Date: Thu, 30 Jan 2025 11:13:04 GMT

{
"authzRealm": "a2x**************qan77rj4h",
"clientIp": "2a02:908:534:*******b710:8800",
"detail": "The client does not have the grant needed for the request",
"instance": "https://akab-****************+up.luna.akamaiapis.net/contract-api/v2/contracts/identifiers?depth=TOP",
"method": "GET",
"requestId": "6957f7d9",
"requestTime": "2025-01-30T11:13:04Z",
"serverIp": "2a02:26f0:1700:38e::1f3f",
"status": 403,
"title": "Forbidden",
"type": "https://problems.luna.akamaiapis.net/-/pep-authz/deny"
}

[lsadlon]

Hi @mguentge

Thanks for reporting it. I created internal ticket for investigation and we will inform you about progress.

BR,
Lukasz

[Rahulbhatvedekar]

Hi @mguentge,
Could you please check if your API credentials include the following grants?

• CPS
• Contracts-API_Contracts

Missing either of these could result in the 403 error you're encountering. Let us know what you find, and we’ll be happy to assist further.

[mguentge]

Both grants are setup:

• CPS (with READ-WRITE)
• Contracts-API_Contracts (with READ-ONLY as this is the only selectable option here)

However, 403 is still occuring.

[Rahulbhatvedekar]

Thanks @mguentge for confirming the grants. We’ll investigate this further on our end and get back to you as soon as we have more information.