API Questions - Tracking Registrations & Adding to Groups

Ben Smith

Folks:

We need advice on how to implement a Create API in a way that will allow us to add sign ups to a Group and/or use the "Origin" field to track unique websites where our API registrations are coming from. Here's our issue:

• We want to configure an API to collect newsletter sign ups from our websites - one example: www.thirteen.org/sundayarts

• Users fill in email address, click submit and are added to Convio via API, AND are also taken to a sign up survey form where they can fill in the rest of their info if they like.

• We need to know the best way to track the sources for each API sign up from the many different websites we're placing it on.

• We tried to configure each API to automatically add sign ups from each site to a Group ("add_group_ids"), but it wasn't working. No error message - its just that the registrants weren't appearing in the Groups that we trieed to add them to. Can someone confirm that this should work and how to implement it? Is there a bug preventing it from working?

• We could also use Origin, but while Convio is allowing us to create custom Origin values for each site, those custom values aren't appearing in the Origin query pull down menu.

Can you help us unfold this mystery? The documentation in Open.convio.com isn't clear. Thanks guys.

tommy Spann

Can you share the code that references the group? Let's take a look at how exactly you are adding users to the group.

Ben Smith

tommy Spann:

Can you share the code that references the group? Let's take a look at how exactly you are adding users to the group.

We're doing a POST request to the API with the parameter "add_group_ids" set to 20581. It's working for the other parameters "primary_email", "method", "login_name", "login_password", "v" and "api_key", but not that one. The request is being received, it's not giving an error response, users are added, but they are not being put in the correct group. We also tried creating a new group with a different group type-- so it may be under 20681 now. Regardless, it still wasn't working.

tommy Spann

Ok - I think I figure this out (with help). It turns out the "add_group_ids" parameter is not usable with client-side API calls. This is for security purposes. Note the comment in the parameter documentation of "Only available when called using administrator accounts". This means that the caller must have been authenticated as an administrator. Without this restriction, a user could use hackery to add himself to a group that he doesn't belong in, possibly giving himself some special access or benefit that he shouldn't have. The UI doesn't let users add themselves to any group, so the API wasn't allowed to expose that risk.

Because of this, I may altogether remove that parameter from the client-side documentation, stay tuned.

But here's some good news, there is a workaround. In Convio groups can be dynamically built using queries, so you can use the API to pass through a value in a custom field or existing standard field that you then query to build your group.

Ben Smith

tommy Spann:

Ok - I think I figure this out (with help). It turns out the "add_group_ids" parameter is not usable with client-side API calls. This is for security purposes. Note the comment in the parameter documentation of "Only available when called using administrator accounts". This means that the caller must have been authenticated as an administrator. Without this restriction, a user could use hackery to add himself to a group that he doesn't belong in, possibly giving himself some special access or benefit that he shouldn't have. The UI doesn't let users add themselves to any group, so the API wasn't allowed to expose that risk.

Because of this, I may altogether remove that parameter from the client-side documentation, stay tuned.

But here's some good news, there is a workaround. In Convio groups can be dynamically built using queries, so you can use the API to pass through a value in a custom field or existing standard field that you then query to build your group.

We didn't do this client-side, we did it server-side, so does that make a difference?

tommy Spann

Ben Smith:

We didn't do this client-side, we did it server-side, so does that make a difference?

Yes that definitely makes a difference. Using the server-side methods you are authenticating as an administrator and therefore have privileges not permitted when using the client-side APIs. Adding records to a group through a server-side script is certainly possible. What is your code base? Are you using PHP (I noticed portions of wnet.org use PHP). Here is some sample php code: http://open.convio.com/api/constituent-api/server/code/createusersamplecode.txt. This sample code does not have the "add_group_ids" paramter, but you can add it easily.

It's very difficult to say what is wrong without diagnosing the code. I'm not a PHP expert but if you are willing to share the code here, perhaps someone with PHP skills can take a look.

Ben Smith

Tompkins - we figured it out. Its working now to pass directly into a Group from the API. We're not sure why its working now - we're looking into it and i'll try to remember to get back to you. Thanks for your help.

tommy Spann

Ben Smith:

Tompkins - we figured it out. Its working now to pass directly into a Group from the API. We're not sure why its working now - we're looking into it and i'll try to remember to get back to you. Thanks for your help.

Excellent! Yes please remember to document whatever lessons you learned back to this thread so others can take advantage.

Kristine Amendola 2

tommy Spann:

Excellent! Yes please remember to document whatever lessons you learned back to this thread so others can take advantage.

Hi.

Message was edited by: kamendola

We are developing our new Web site with API.

Is there a way we can check the Convio password so that our constituents can sign into our FFB Web site.

Using the Constituent and SSO API's, we are looking to setup a situation where FFB only needs 1 member database (at Convio) and to allow members to login to both the website and Convio via the website. The issue comes in when we are trying to log the user in. If we ask for an email and a password on the web, we can call getUser with the email address to get the appropriate cons_id to pass to getSingleSingOnToken. However, when examining the response of getUser, there is no password field included. Without a password we obviously cant authenticate the credentials to see whether or not to really log this user in. Is there any way to include the password in the getUser response? If it comes over encrypted, then we would also need to know what hash function (md5, sha, etc) you are using so we could run the same encryption on our end to get a match.

Jeff Mills

Kristine Amendola:

Hi.

Message was edited by: kamendola

We are developing our new Web site with API.

Is there a way we can check the Convio password so that our constituents can sign into our FFB Web site.

Using the Constituent and SSO API's, we are looking to setup a situation where FFB only needs 1 member database (at Convio) and to allow members to login to both the website and Convio via the website. The issue comes in when we are trying to log the user in. If we ask for an email and a password on the web, we can call getUser with the email address to get the appropriate cons_id to pass to getSingleSingOnToken. However, when examining the response of getUser, there is no password field included. Without a password we obviously cant authenticate the credentials to see whether or not to really log this user in. Is there any way to include the password in the getUser response? If it comes over encrypted, then we would also need to know what hash function (md5, sha, etc) you are using so we could run the same encryption on our end to get a match.

See my reply at http://community.customer.convio.com/thread/1577