# Cumulocity API calls resulting in Invalid credentials

**URL:** <https://community.cumulocity.com/t/cumulocity-api-calls-resulting-in-invalid-credentials/4032>\
**Category:** Forum\
**Tags:** cumulocity\
**Created:** [June 30, 2022, 5:53pm UTC](https://community.cumulocity.com/t/cumulocity-api-calls-resulting-in-invalid-credentials/4032 "2022-06-30T17:53:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![edso](https://avatars.discourse-cdn.com/v4/letter/e/e47774/32.png) [@edso](https://community.cumulocity.com/u/edso)\
**Post date:** [June 30, 2022, 5:53pm UTC](https://community.cumulocity.com/t/cumulocity-api-calls-resulting-in-invalid-credentials/4032/1 "2022-06-30T17:53:43Z")

</div>

#### What product/components do you use and which version/fix level?

Cumulocity IoT tenant Backend: **1013.0.143** UI: **1013.0.143**

#### Are you using a free trial or a product with a customer license?

Partner tenant

#### What are trying to achieve? Please describe in detail.

Trying to create a device using Postman with c8y library imported.  
Tried {{url}}/inventory/managedObjects with:  
body : {  
“name”: “testMeasurementDevice”,  
“c8y\_IsDevice”: {},  
“c8y\_SupportedMeasurements”: [  
“c8y\_TemperatureMeasurement”]  
}

Checked and double checked my user id and password used in creating the OAuth to be correct and was able to use it to login to my tenant. But the Postman API call failed.  
I do have the right roles as a Cumulocity user on my tenant.

#### Do you get any error messages? Please provide a **full error** message screenshot and log file.

“error”:“general/internalError”,“message”:"Invalid credentials! : The user agent is forbidden for Basic Authentication.

#### Have you installed latest fixes for the products

I think this is the latest release

---

<div class="post-metadata">

**Author:** ![Korbinian\_Butz](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/korbinian_butz/32/10473_2.png) [@Korbinian\_Butz](https://community.cumulocity.com/u/Korbinian_Butz)\
**Post date:** [June 30, 2022, 7:23pm UTC](https://community.cumulocity.com/t/cumulocity-api-calls-resulting-in-invalid-credentials/4032/2 "2022-06-30T19:23:58Z")

</div>

Hi Eddie,  
I see your error message is refering to the “user agent”. Within Cumulocity Administration it is possible to explicitely trust/forbid requests based on their “user-agent” header field, see more details here: [Administration - Cumulocity IoT Guides](https://cumulocity.com/guides/users-guide/administration/#changing-authentication-settings)

Thus, could you:

- check in your tenant under Administration\>Settings\>Authentication if there’s according entries for trusted/allowed user-agents
- share the header fields of your Postman request

Best, Korbinian

---

<div class="post-metadata">

**Author:** ![edso](https://avatars.discourse-cdn.com/v4/letter/e/e47774/32.png) [@edso](https://community.cumulocity.com/u/edso)\
**Post date:** [July 1, 2022, 1:50pm UTC](https://community.cumulocity.com/t/cumulocity-api-calls-resulting-in-invalid-credentials/4032/3 "2022-07-01T13:50:52Z")

</div>

Thanks Korbinian.  
Problem fixed per your suggestion.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [September 29, 2022, 1:51pm UTC](https://community.cumulocity.com/t/cumulocity-api-calls-resulting-in-invalid-credentials/4032/4 "2022-09-29T13:51:25Z")

</div>

Closed on September 29, 2022, 1:51pm UTC

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.