Call to API App install failing

[plm27]

Hello,
I am testing my Cloudron install with API calls.
When I try the invoke install app, I am getting a "Bad Request " and I cannot figure out what is wrong with my call, any idea?
curl -X POST https://my.smthg.com/api/v1/apps/install?access_token=<removed> 26dad6909df7c716ff -d '{"appStoreId": "io.n8n.cloudronapp@2.37.0","subdomain": "workflow","domain": "smthg.com","accessRestriction": "null"}'

returns

{
"status": "Bad Request",
"message": "appStoreId or manifest is required"
}
I first ran, and captured, the install directly from the GUI to validate the parameters, then removed the new app.
Cheers
Pierre

[nebulon]

Can you try to add -H "Content-Type: application/json" to the curl command?

[BrutalBirdie]

@plm27
Example fetched directly from the browser when installing an app:

curl 'https://my.DOMAIN.TLD/api/v1/apps/install' -X POST -H 'Authorization: Bearer REDACTED-TOKEN' -H 'Content-Type: application/json;charset=utf-8' --data-raw '{"appStoreId":"io.hackmd.cloudronapp@1.16.1","subdomain":"hdoc","domain":"DOMAIN.TLD","secondaryDomains":{},"portBindings":{},"accessRestriction":{"users":[],"groups":[]},"cert":null,"key":null,"overwriteDns":false}'

This execute with to correct values for the Domain and Token returns:

"id": "461ea9bb-ed4e-4d19-8e13-dea542e5b19a",
"taskId": "2441"
}

Your ?access_token seams odd, I always used bearer token auth.

[plm27]

Hi Nebulon,
Thx, that should be it. I didn't pick up that I forgot the header.
Testing and reverting.

[plm27]

@nebulon, @BrutalBirdie
Thx to both of you, the call is now working.
curl -kX POST -H "Content-Type: application/json" https://my.smthg.com/api/v1/apps/install?access_token=857f7d7eb583cfb951e5a50c75a762b94304d4ba50d4a0c94950643eaab7959a -d '{"appStoreId": "io.n8n.cloudronapp@2.37.0","subdomain": "workflow","domain": "somethg.com","accessRestriction": {"users":[],"groups":[]}}'
{
"id": "c6c79d78-7c7c-414b-acf7-8b5cc39370ed",
"taskId": "269"
}

It needed obviously the header, but also I thought reading the API specs that accessRestriction could be null. It is not the case, so I used @BrutalBirdie assignment (empty users and groups) and the call succeeded.
Once again thank you very much.