Getting 403 Errors when making a POST request to Deployment API (/deployment/api/resources/{resourceId}/requests)

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VCF Automation

Issue/Introduction

• When making a POST call to the Deployment API (/deployment/api/resources/{resourceId}/requests) via Orchestrator Workflow, Postman, or from the Swagger UI in Automation, you receive a 403 Forbidden response.
• You can make GET calls to the same API successfully.
• Making a GET call to /deployment/api/resources/{resourceId}/actions, where {resourceId} is the component's Resource ID, returns a 200 response but does not include the action you are trying to run.
• In the UI, when looking at the actions available to the VM component, there is no Update Tags action (or the specific action you are trying to run) showing.
• The user has the appropriate permissions to run the action, or is a full administrator in Assembler and Service Broker.

Environment

• Aria Automation 8.x
• VCF Automation 9.x

Cause

This API requests an action run from Automation, but there is a policy configured that restricts access to the action, which causes the 403 Forbidden response.

Resolution

Update the policy that restricts the action for the user making the API call in Service Broker.

1. Log into the Automation portal in a browser.
2. Go to Service Broker > Content & Policies > Definitions.
3. Find any policies that include the affected user or the group that they are a member of.
4. Update the policy to include the Cloud.vSphere.Machine.Update.Tags action or the action that needs to be run via API.
5. Save the policy.
6. Log out and then log back in.
7. Verify that Update Tags or the desired action is available for the component in the deployment UI.
8. Try the POST call via API again.