# Access to the API denied

**URL:** <https://forum.inaturalist.org/t/access-to-the-api-denied/57916>\
**Category:** General\
**Tags:** api, projects\
**Created:** [November 5, 2024, 9:12am UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916 "2024-11-05T09:12:59Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![thierrya](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/thierrya/32/41066_2.png) [@thierrya](https://forum.inaturalist.org/u/thierrya)\
**Post date:** [November 5, 2024, 9:12am UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/1 "2024-11-05T09:12:59Z")

</div>

Hello everyone,

I’m already using the API quite a lot, in anonymous mode, but only for reading data, and only regarding my own observations.  
My purpose is to keep my private DB in sync with the corresponding observations I published on iNat.  
I usually read from the API only a few values: Taxon.ID, observation\_count, Place Name, etc…

**My problem**  
I noticed that for taxon I observed that are endangered, I cannot get the real place name, because it is obscured (and I’m OK with that on principle)

So I decided to try Oauth, in order to be allowed to query the protected data from my own observations.  
I discovered that to do that you have to “apply to be an app owner”, and that the conditions are:

> In order to submit an application your account must be at least 2 months old and must have made at least 10 improving identifications in the last month.

**My question**  
Why on earth (and elsewhere 😁) should you be expert enough to provide 10 improving IDs in less than a month, to be allowed to code using Oauth ?

I’m no beginner , but I’m certainly no specialist and that bar feels too high for me…

---

<div class="post-metadata">

**Author:** ![pisum](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@pisum](https://forum.inaturalist.org/u/pisum)\
**Post date:** [November 5, 2024, 2:07pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/2 "2024-11-05T14:07:22Z")

</div>

> [@thierrya](#):
>
> So I decided to try Oauth, in order to be allowed to query the protected data from my own observations.  
> I discovered that to do that you have to “apply to be an app owner”

where did you get the idea that you need to be an app owner to do what you’re describing? (i’m guessing maybe you’re a pyinaturalist user, and you saw this in the pyinaturalist documentation? if that’s true, you really should read the iNaturalist API documentation instead.)

> [@thierrya](#):
>
> I usually read from the API only a few values: Taxon.ID, observation\_count, Place Name, etc…

you could also just get this information from the standard iNatuarlist CSV export.

---

<div class="post-metadata">

**Author:** ![reuvenm](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/reuvenm/32/65_2.png) [@reuvenm](https://forum.inaturalist.org/u/reuvenm)\
**Post date:** [November 5, 2024, 3:47pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/3 "2024-11-05T15:47:29Z")

</div>

> [@pisum](#):
>
> where did you get the idea that you need to be an app owner to do what you’re describing? (i’m guessing maybe you’re a pyinaturalist user, and you saw this in the pyinaturalist documentation? if that’s true, you really should read the iNaturalist API documentation instead.)

I believe the OP is correct about this - you cannot retrieve non-public coordinates for your own observations through the api without an OAuth token, and you cannot create one except through the application process described.

> [@thierrya](#):
>
> I’m no beginner , but I’m certainly no specialist and that bar feels too high for me…

I believe the purpose of this restriction is to ensure people are familiar with the iNat community and application before attempting to make authenticated requests that have the power to make database changes. As such I won’t list the details here, but I’ll just say that it is _extremely easy_ to make 10 legitimate improving identifications without any identification/taxonomic expertise whatsoever.

---

<div class="post-metadata">

**Author:** ![jwidness](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@jwidness](https://forum.inaturalist.org/u/jwidness)\
**Post date:** [November 5, 2024, 3:59pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/4 "2024-11-05T15:59:28Z")

</div>

You definitely don’t need to be an app owner to make authenticated API calls, see [https://forum.inaturalist.org/t/how-to-apply-for-an-api-app-id/47171/2](https://forum.inaturalist.org/t/how-to-apply-for-an-api-app-id/47171/2) for one example of how to do it. Other examples exist elsewhere on the forum.

---

<div class="post-metadata">

**Author:** ![pisum](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@pisum](https://forum.inaturalist.org/u/pisum)\
**Post date:** [November 5, 2024, 4:04pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/5 "2024-11-05T16:04:26Z")

</div>

> [@reuvenm](#):
>
> I believe the OP is correct about this - you cannot retrieve non-public coordinates for your own observations through the api without an OAuth token

i assume you also think this you’re pyinaturalist user, right?

---

<div class="post-metadata">

**Author:** ![reuvenm](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/reuvenm/32/65_2.png) [@reuvenm](https://forum.inaturalist.org/u/reuvenm)\
**Post date:** [November 5, 2024, 4:11pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/6 "2024-11-05T16:11:51Z")

</div>

No, I’ve never personally had any need to make authenticated api calls so have never tried, just reading the docs.

Anyways, the api docs are I think misleading on this and I made exactly the same misunderstanding as OP here. The only sentence that links to your own API token page is this:

> To obtain one, make an [OAuth-authenticated request](http://www.inaturalist.org/pages/api+reference#auth) to [https://www.inaturalist.org/users/api\_token](https://www.inaturalist.org/users/api_token). Each JWT will expire after 24 hours

Which pretty strongly implies that the first link (to OAuth-authenticated request) is a necessary part of the process. That link includes the sentence:

> Before you make any authenticated requests, you’ll need to [create an iNat application](https://www.inaturalist.org/oauth/applications/new).

Maybe it would be obvious to a more experienced developer that as a logged-in user, the api token link will just give you what you need, but for someone like me who just cobbles together little apps a few times a year when I need to do something specific, it is very much non-obvious.

---

<div class="post-metadata">

**Author:** ![bazwal](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/bazwal/32/109_2.png) [@bazwal](https://forum.inaturalist.org/u/bazwal)\
**Post date:** [November 5, 2024, 10:12pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/7 "2024-11-05T22:12:43Z")

</div>

> [@reuvenm](#):
>
> the api docs are I think misleading on this and I made exactly the same misunderstanding as OP here

The docs should give much greater prominence to this page:

- [API Recommended Practices](https://www.inaturalist.org/pages/api+recommended+practices)

This explains the authentication process a lot more clearly, and should be required reading for anyone thinking about using the APIs. There’s a lot of very important information there about how to use the service correctly (and responsibly). Unfortunately, this link is buried half-way down the [developers page](https://www.inaturalist.org/pages/developers), when it should really be one of the first things you see on the [main API reference page](https://www.inaturalist.org/pages/api+reference).

---

<div class="post-metadata">

**Author:** ![cthawley](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/cthawley/32/1445_2.png) [@cthawley](https://forum.inaturalist.org/u/cthawley)\
**Post date:** [November 5, 2024, 10:52pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/8 "2024-11-05T22:52:52Z")

</div>

I think the requirement is generally intended to make sure someone is at least a bit familiar with how iNat works before submitting an application, similar to the project creation requirement. There have been instances of people who know very little about how iNat works trying to make programs that add machine generated content, etc. This requirement is a pretty low bar in my opinion. Looking at a general ID search for observations at “Plants” or “Animals” or whatever general taxon you have some expertise in will allow you to make 10 improving ID in a matter of minutes I would think.

---

<div class="post-metadata">

**Author:** ![thierrya](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/thierrya/32/41066_2.png) [@thierrya](https://forum.inaturalist.org/u/thierrya)\
**Post date:** [November 6, 2024, 1:07pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/9 "2024-11-06T13:07:38Z")

</div>

> [@pisum](#):
>
> pyinaturalist

No, I’m not using pyinaturalist (I had to look it up…)  
I code in C#.

And that is why I can tell that when you retrieve the location of a protected species without autentication, you get an “obscured” location, like “Belgium” for Botaurus stellaris.  
What would be the point of obscuring locations otherwise… ?

I tried to use the CSV download. It “sort of” works, providing a private\_place\_guess but to do that you have to be authenticated in the web interface. And this has to be a manual process. Not a solution.

---

<div class="post-metadata">

**Author:** ![thierrya](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/thierrya/32/41066_2.png) [@thierrya](https://forum.inaturalist.org/u/thierrya)\
**Post date:** [November 6, 2024, 1:12pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/10 "2024-11-06T13:12:07Z")

</div>

Yes, I think this is the information I was looking for, thanks !

---

<div class="post-metadata">

**Author:** ![pisum](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@pisum](https://forum.inaturalist.org/u/pisum)\
**Post date:** [November 6, 2024, 1:21pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/11 "2024-11-06T13:21:21Z")

</div>

if you want the process to be fully automated, then for the same reasons you say a csv doesn’t work for you, the fully automated way to get a JWT would also generally require registering an app. so then you just need to accept and meet the identification requirements to apply to be an application owner.

---

<div class="post-metadata">

**Author:** ![thierrya](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/thierrya/32/41066_2.png) [@thierrya](https://forum.inaturalist.org/u/thierrya)\
**Post date:** [November 6, 2024, 1:24pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/12 "2024-11-06T13:24:18Z")

</div>

And that is where I’m stalled…  
To make 10 improving IDs ?  
An improving ID is one where you are the first to suggest an ID that is more precise than the initial one and then is later confirmed by the community.  
Maybe easy for some…

---

<div class="post-metadata">

**Author:** ![pisum](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@pisum](https://forum.inaturalist.org/u/pisum)\
**Post date:** [November 6, 2024, 1:33pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/13 "2024-11-06T13:33:37Z")

</div>

> [@thierrya](#):
>
> And that is where I’m stalled…  
> To make 10 improving IDs ?

you’ve been given other options, and you decided you don’t want to go down those other paths. so if that’s how you want to proceed, then you just have to figure it out. cthawley described the reasoning for the requirements, and i agree with him that it’s a low bar to meet. your time would be better spent figurng it out rather than trying to protest the requirements.

---

<div class="post-metadata">

**Author:** ![frousseu](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/frousseu/32/22334_2.png) [@frousseu](https://forum.inaturalist.org/u/frousseu)\
**Post date:** [November 6, 2024, 2:34pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/14 "2024-11-06T14:34:26Z")

</div>

As already been said, getting 10 improving IDs should be very easy. According to the definition, an improving ID is one that is a first suggestion of a taxon that the community agrees with. So, just go through the unknowns of your area (131 pages!) [https://www.inaturalist.org/observations/identify?iconic\_taxa=unknown&place\_id=6753](https://www.inaturalist.org/observations/identify?iconic_taxa=unknown&place_id=6753), add broad IDs (animal, plant, etc.) and following agreeing or refining IDs will make yours an improving one.

---

<div class="post-metadata">

**Author:** ![thierrya](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/thierrya/32/41066_2.png) [@thierrya](https://forum.inaturalist.org/u/thierrya)\
**Post date:** [November 12, 2024, 5:40pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/15 "2024-11-12T17:40:47Z")

</div>

Hi,  
Yes, you were right, all of you, it wasn’t so difficult to add 10 improving IDs…  
I’m feeling a bit stupid to have thought it would be out of my reach.  
So thank you for pushing me out of my comfort zone !  
Have a nice day.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/inaturalist/original/2X/7/7831452cf7f0d653ff1ffd34176334b7ef1b6a17.png) [@system](https://forum.inaturalist.org/u/system)\
**Post date:** [January 11, 2025, 5:41pm UTC](https://forum.inaturalist.org/t/access-to-the-api-denied/57916/16 "2025-01-11T17:41:36Z")

</div>

Closed on January 11, 2025, 5:41pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
