Cannot access Azure DevOps API using PAT in cURL command in Bash script

Question

I have a script that uses the Azure DevOps API to retrieve every work item in a query. Then it retrieves the metadata for each work item. It requires a PAT. Until today the PAT has worked. I believe it is expired. I created a new PAT, but every attempt to retrieve the same information is unauthorized (401).

The cURL command in my script that worked until now:

ado_token={[email protected]:PAT, all Base-64 encoded as one string}

curl -X GET -H "Authorization: Basic $ado_token" -H 'Cache-Control: no-cache' "https://dev.azure.com/{company}/{project}/_apis/wit/wiql/{query ID}?api-version=5.1"

Here are the facts:

• Going to the URL directly in the browser succeeds.
• The new token is in the same project as the URL.
• The new token has full access.

Microsoft documentation on ADO PATs provides this example:

curl -u username[:{personalaccesstoken}] https://dev.azure.com/{organization}/_apis/build-release/builds

However, when my username and PAT are entered with a URL I know to be correct, it is unauthorized.

Both in the format of the Microsoft example and the URL I would like to use in my script, these are all unauthorized in all iterations of Bearer and Basic. The URL used works in the browser:

• {username}:{PAT}
• {username}@{company}.com:{PAT}
• Base-64 encoded {PAT}
• Base-64 encoded {username}@{company}.com:{PAT}
• Base-64 encoded pat:{PAT}
• Base-64 encoded {username}:{PAT}
• Base-64 encoded {username}@{company}.com:{PAT}

I have tried both in the command line and Postman but no added information was provided.

Am I missing something obvious? The most confusing aspect of this is that the previous PAT worked in this same code. Thank you for any help.

Answer 1

Try the command below:

curl -u :${PAT} 'https://dev.azure.com/{company}/{project}/_apis/wit/wiql/{query ID}?api-version=5.1'

In the -u parameter the Username field must be blank and the PAT is the original string.

Do NOT base64-encode the string; the -u will do that for you.

Thus the command would be in the following format:

curl -u :lplnqn4l4glwqkslsfel7t2wjevfi5tayuiwm772qeawbwo3ztua 'https://dev.azure.com/acme/projetx/_apis/wit/wiql/6cbbddb4-f752-453b-9f98-f523470826fe?api-version=5.1'

Answer 2

Postman

1. using Authorization without username: Choose Basic Auth. and enter the PAT as password.
2. using Headers: Use key as Authorization and value as Basic {Base-64 encoded pat{:PAT}}. Note that {:PAT} needs to be base64 encoded

Curl

1. using basic authentication without username: curl -u :{PAT} https://dev.azure.com/{org}/_apis/projects
2. using headers: curl -H 'Authorization: Basic {Base-64 encoded pat{:PAT}}' https://dev.azure.com/{org}/_apis/projects