Nagios script returns 403 error when querying CiviCRM via Ajax API

Question

I've recently started using the check_civicrm script from https://github.com/MegaphoneJon/check_civicrm

It works great and my monitoring is greatly improved. However, on some sites I get a 403 error instead of expected response from CiviCRM. I successfully determined that the earlier 500 errors were due to lack of anonymous permission on "CiviCRM: access AJAX API".

Adding to the mystery is the fact that two of the installations are on the same server. One gives expected output, the other a 403. I assume there is some additional permission required somewhere, but I am at a loss to figure out what.

The Civi log is not particularly edifying either, just telling me Civi\API\Exception\UnauthorizedException: "Authorization failed"

UPDATE: I have dug into the script and see that is is making a POST request to https://sitename.com/civicrm/ajax/api4/System/check. When I visit it in a browser I get a 401 error and the message "Ajax requests can only be issued by javascript clients, eg. CRM.api4().".

Any thoughts?

Answer 1

After more digging in response to my Ajax check in a browser I found a question: How can I call api directly from external http?, that didn't answer my question, but referenced the AuthX extension. I thought I would take a look at my sites' extension lists.

The sites that weren't talking to me did not have the AuthX CiviCRM extension installed and the ones that were communicating, did. After installing the AuthX extension, the site would talk to me without any further configuration.

I do not know what underlying services or restrictions are involved, but this provided a path through. Hopefully this is useful to some other searcher (maybe future me).