# Access Open edX api's from frontend/postman using tutor

**URL:** <https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101>\
**Category:** Development\
**Tags:** tutor\
**Created:** [August 17, 2022, 7:11am UTC](https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101 "2022-08-17T07:11:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![VASANTH\_KUMAR](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vasanth_kumar/32/4168_2.png) [@VASANTH\_KUMAR](https://discuss.openedx.org/u/VASANTH_KUMAR)\
**Post date:** [August 17, 2022, 7:11am UTC](https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101/1 "2022-08-17T07:11:42Z")

</div>

We’re creating a custom frontend from openedx APIs using tutor. But when I try to access APIs from a react app or postman I’m getting CORS/403 error but some API’s like /api/bookmarks/v1/bookmarks are working but when I try /api/user/v1/login\_session it’s giving me 403.  
I added my domain in xdomainproxyconfiguration whitelist still I’m getting CORS error  
[http://local.overhang.io/admin/cors\_csrf/xdomainproxyconfiguration/](http://local.overhang.io/admin/cors_csrf/xdomainproxyconfiguration/)  
Please guide me on how we go about this.

---

<div class="post-metadata">

**Author:** ![nsprenkle](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/nsprenkle/32/304_2.png) [@nsprenkle](https://discuss.openedx.org/u/nsprenkle)\
**Post date:** [August 17, 2022, 6:52pm UTC](https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101/2 "2022-08-17T18:52:16Z")

</div>

Hi @VASANTH_KUMAR 👋 I would start by taking a look at [How to authenticate and query edX APIs with Postman](https://openedx.atlassian.net/wiki/spaces/AC/pages/3516268561/How+to+authenticate+and+query+edX+APIs+with+Postman) as a starting point. Has info on standard Postman setup that might be missing.

---

<div class="post-metadata">

**Author:** ![VASANTH\_KUMAR](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vasanth_kumar/32/4168_2.png) [@VASANTH\_KUMAR](https://discuss.openedx.org/u/VASANTH_KUMAR)\
**Post date:** [August 18, 2022, 4:40am UTC](https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101/3 "2022-08-18T04:40:11Z")

</div>

Hi, @nsprenkle thank you will check this out.

---

<div class="post-metadata">

**Author:** ![sarina](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/sarina/32/2308_2.png) [@sarina](https://discuss.openedx.org/u/sarina)\
**Post date:** [August 19, 2022, 8:47pm UTC](https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101/4 "2022-08-19T20:47:24Z")

</div>

Hi! I’ve moved your question to the “Development” topic. Choosing the right topic when you make a post is important for visibility; the default (“Community”) is almost never what you want.

---

<div class="post-metadata">

**Author:** ![allen\_luna](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/allen_luna/32/6435_2.png) [@allen\_luna](https://discuss.openedx.org/u/allen_luna)\
**Post date:** [July 30, 2024, 11:21pm UTC](https://discuss.openedx.org/t/access-open-edx-apis-from-frontend-postman-using-tutor/8101/5 "2024-07-30T23:21:31Z")

</div>

hi @nsprenkle

Just wanna ask if I am correct, My output is  
Status Code: 400  
Content-Type: application/json  
Response Content Length: 123  
Response JSON: {‘success’: False, ‘value’: ‘There was an error receiving your login information. Please email us.’, ‘email’: None}

import requests

# URL to get the CSRF token and cookie

initial\_get\_url = ‘[https://courses.edx.org](https://courses.edx.org)’

url = ‘[https://courses.edx.org/api/user/v2/account/login\_session/](https://courses.edx.org/api/user/v2/account/login_session/)’

response = requests.get(url)

csrf\_cookie = response.cookies.get(‘csrftoken’)

print(csrf\_cookie)

# Data to send in the POST request

data = {  
“email”: “[example@gmail.com](mailto:example@gmail.com)”,  
“password”: “mypassword”  
}

# Headers for the request

headers = {  
‘Accept’: ‘application/json’,  
‘X-CSRFToken’: csrf\_cookie,  
‘Content-Type’: ‘application/json’,  
‘Referer’: initial\_get\_url  
}

response = requests.post(url, json=data, headers=headers, cookies={‘csrftoken’: csrf\_cookie})

print(“Status Code:”, response.status\_code)  
print(“Content-Type:”, response.headers.get(‘Content-Type’))  
print(“Response Content Length:”, len(response.content))

if ‘application/json’ in response.headers.get(‘Content-Type’, ‘’):  
try:  
response\_json = response.json()  
print(“Response JSON:”, response\_json)  
except requests.exceptions.JSONDecodeError:  
print(“Response is not valid JSON.”)  
else:

```
print("Response is not JSON or Content-Type is missing.")
print("Response Content:", response.text)

```