Testing Strapi Endpoints with Postman
All right then so now we have our reviews data in Strapi and Strapi has generated those end points for us to fetch those reviews.
Well, let's try doing that now. Later in the course, we'll be fetching all the data from a React site, but to begin with, I just want to test the endpoints using Postman. Now Postman is a completely free tool which you can download at postman.com and it allows us to quickly test REST API endpoints. So I'll leave the link to download that down below the video in the video description.
Once you have it installed, you might need to sign up for a free account before you use it. And when you sign in you're going to see something like this. It might look a little bit different if you're using a different version to me, but the general gist is going to look something like this. So to make a new request, let's go to new up here and choose a new request.
And then we need to select the request method first of all. I'm going to keep it at GET since we're sending a GET request. Next to that is the end point that we want to make the request to. In our case that's going to be http://localhost:1337/reviews. So once you've entered that in, finally we can save this request, meaning anytime I open this saved request in the future, this little bit of configuration right here is going to be saved as well. So to do that, click on save over here and we'll name this All reviews then add it to a new collection called Strapi. So we're going to group all of our request tests together in a folder called Strappy and then we'll save it so we can use it again later.
And now you'll notice this folder on the left called Strappy and our request inside it. So now we can send the request and see what response we get back down here.
Understanding Public Permissions and 403 Errors
So the response is basically going to be a JSON object and at the minute, it's sending back an error saying "Forbidden" with a status code of 403, which means we don't have permission to access the data.
This is basically because by default when we make content types in Strapi, Strapi automatically protects that content from the public and we have to explicitly make it public so we can access it using requests like this.
So let's do that now in the Strappy admin area. So to begin with we need to go to Settings and then Roles here under Users and Permissions. Then we want to click on the Public role, which would basically be the role of any user browsing the site who's not logged in or anything. Inside that, we can see our content type down here, reviews. Later if you make more content types, you're going to see them here as well.
So what we need to do is check whatever boxes we want to make accessible when we're making requests. At the moment, nothing down here is checked, meaning everything is protected from the public role users who are not logged in. That means if we try to request anything from the front end, we get that 403 response.
So I'm going to check the find box right here and that means that unauthorized or unauthenticated users can make a request to get a list of all of the reviews. I'm also going to check the find one box and this means that unauthenticated users can make requests to get single review records. I'm going to leave the rest unchecked because I don't want to allow anyone to make post requests to add data or delete requests to delete data, etc. Those things should be protected from the public role.
Now click on save to save those changes.
Fetching All & Single Reviews Successfully
And all we have to do now is switch back to Postman and try this out.
So now inside Postman if I press send again, we can see that now I get a list of all of the reviews back in the JSON response. Cool. And notice also for each review that we get, we get these extra fields that Strappy has added on for us when it was published, created, and last updated, which is pretty nice.
All right, so now let's try fetching a single review instead of all the reviews. To do that, we're going to make a new request. So again, this is going to be a GET request, but this time the end point is going to be http://localhost:1337/reviews/2. So now this should fetch the single review with the id of two.
Before we send it, I'm going to save the request first of all, and this time I'm going to call it Single review. And we're also going to save it to the Strappy collection. So once we've done that we can hit send, and now we can see that single review in the response down here. Awesome.
The Need for Authenticated Requests
Now what if we try to send a delete request to delete a review? Well, let's give it a whirl. First of all, we'll need to go and make a new request. And now this time the request type is going to be delete, so select that first of all. And the end point is going to be the same as the end point for getting a single review. So let me just go and copy that and then we can paste it back in there. And then I'm going to save the request and this time let's call it Delete review. And again we're going to put it inside the Strappy collection.
Now ideally, when we send this request it is going to delete the review with the id of two. So let's hit send and we get back that four or three error. And again, that's because for unauthenticated users, the public role, we didn't allow delete requests. And to be honest, I wouldn't just want anyone to make delete requests to delete my data. I'd only want people who are authenticated maybe to do that. So let's have a quick look at how that works in Strappy.
Setting Up Authenticated Roles and Users
So first up head to the settings again, then into roles, and then this time we want the authenticated role. So this would be for users who are logged into the website using the Strappy auth system. So down here we can check all the boxes to say authenticated users are allowed to do all of this, and then we can click save. And by the way, that includes deleting records.
All right so now we actually need to make a user on Strappy so that we can authenticate as that user on the front end, in Postman for now, and then make the delete request as that user. Remember Strappy has already created a user type for us and it uses this for authenticating requests. So I can click on this and create a new user. So let's do that.
Now we can give this user a username. I'm going to call it yoshi, and then also an email which I'm going to say is [email protected]. And then finally a password which again I'm going to set to be Test1234. Then I'm going to click on confirm to confirm the user and I'll set the role of this user to Authenticated, meaning it's going to have all the permissions of the authenticated role that we just set up. So this user will be allowed to delete reviews, update them, and create them.
So let's give this a whirl now in Postman.
User Authentication and JSON Web Tokens (JWT)
All right then. So the first thing we need to do is log this user in from the front end, so to speak—the front end just being Postman for now. So to do this we need to send a request to Strapi to a specific authentication endpoint along with the user's credentials that they use to log in: the email or the username rather, and the password.
So again, let's make a new request and this time it's going to be a POST request because we're going to send data to log in. And the end point that we use to authenticate is going to be http://localhost:1337/auth/local. And now this is a post request and we have to send the username and password in the request body so this Strapi can authenticate us when it receives this request.
So go to the body and then click on raw and then select JSON so we're sending some raw JSON in the request body. Now inside the JSON object, we need two properties. The first one is the identifier, which is basically the username, and the value of that in our case is yoshi. And the second one is the password property. And remember we set that to be Test1234 with a capital T.
So now we have this post request set up. Let me first of all save it and we'll call it Login. And again save it to the strappy folder. Okay, so hopefully if we send this request we get a good response from Strappy, and we can see that now down below.
So notice it sent us information about the user who's just logged in, such as the username, the email, the id, etc. But also, it sent us this JWT. This is a JSON Web Token that Strappy has generated for this user. And if now a request is sent to Strapi using this JSON Web Token, Strapi can authenticate that user on the back end using the JWT. And then it can allow that user to do things like make a delete request. So let's copy that JWT for now.
Authorizing Requests with a Bearer Token
And head back to our delete request. So currently remember if we make this request without the JWT, it's sending back a 403 error. But if we click on authorization here and choose bearer token from the drop down, we can paste the JWT in right here. And then this will be sent to Strapi along with our request when we hit send, so that Strappy can look at the token, we can validate it, and see that we are logged in.
And this is generally the way JWT auth works with apis. We send the token back and forth between the front end and the back end to identify the user on the server. And generally we do this via a bearer token like this which can be attached to the request.
Anyway, let's try sending this request now. And notice this time we get back a better response, and we can see the record right here that was deleted. So let's just check in the Strappy admin panel that the record is actually gone. So if we click on reviews, we can see that the one with the id of two is no longer there.
Cool. So hopefully now you understand a little bit more about how we can send requests to Strapi at these different endpoints, and also how we can control the permissions of different roles. Next up, we're going to start on the front end by creating a React app.
