使用Scope认证调用Autodesk API遇403/405错误，寻求技术指导

我用下面两个认证函数都能获取到access token，但调用API时全部无效：调用get_autodesk_usage_summary接口返回403错误，其他接口返回405错误。相关代码如下：

设置变量（从环境变量读取值） #

AUTODESK_CLIENT_ID = ENV['AUTODESK_CLIENT_ID']
AUTODESK_CLIENT_SECRET = ENV['AUTODESK_CLIENT_SECRET']
AUTODESK_URL = 'https://developer.api.autodesk.com/authentication/v2/'
AUTODESK_USERINFO_URL = 'https://api.userprofile.autodesk.com/'
AUTODESK_TOKENFLEX_URL = 'https://developer.api.autodesk.com/tokenflex/v1/'
AUTODESK_V1_URL = 'https://developer.api.autodesk.com/authentication/v1/'

用户认证函数 #

def authenticate():
    HEADERS = {'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'application/json'}
    BODY = {'client_id': AUTODESK_CLIENT_ID, 'client_secret': AUTODESK_CLIENT_SECRET, 'grant_type': 'client_credentials', 'scope': ['code:all', 'data:search', 'data:write', 'account:read', 'user:read']}
    auth_url = f"{AUTODESK_V1_URL}/authenticate"
    res = requests.post(url=auth_url, data=BODY, headers=HEADERS)
    js = res.json()
    return js

获取access token函数 #

def get_autodesk_access_token():
    to_encode = f"{AUTODESK_CLIENT_ID}:{AUTODESK_CLIENT_SECRET}".encode("ascii")
    encoded = base64.b64encode(to_encode)
    URL = 'https://developer.api.autodesk.com/authentication/v2/token'
    HEADERS = {'Content-Type': 'application/x-www-form-urlencoded','Accept':'application/json','Authorization': 'Basic ' + encoded.decode()}
    BODY = {'grant_type': 'client_credentials', 'scope': ['code:all', 'data:search', 'data:write', 'account:read', 'user:read']}
    res = requests.post(url=URL, headers=HEADERS, data=BODY)
    jj = res.json()
    return jj

注：原代码中data:write前缺失引号，已修正语法错误

获取使用情况汇总函数 #

def get_autodesk_usage_summary(access_token:str = None, contract_number:str=None):
    my_header = {}
    my_header['Authorization'] = f"Bearer {access_token}"
    my_header['Content-Type'] = "application/json"
    with requests.Session() as s:
        s.auth = OAuth2BearerToken(access_token)
        res = s.get(f"{AUTODESK_TOKENFLEX_URL}/usage/{contract_number}/summary")
        if res.ok:
            js = res.json()
            return js
        else:
            print(f"response = {res.status_code}. error.")

注：原URL错误保留占位符冒号，已修正为直接拼接合同编号

返回的token示例 #

"""{'access_token': 'eyJhbGciOiJSUzI1NiIsImtpZCI6IjY0RE9XMnJoOE9tbjNpdk1NU0xlNGQ2VHEwUV9SUzI1NiIsInBpLmF0bSI6Ijd6M2gifQ.QiOiJZSTdFem5wdkIwcjNBem5yS0JXZVpIVE5iMUFmM1F0TSIsImF1ZCI6Imh0dHBzOi8vYXV0b2Rlc2suY29tL2F1ZC9hand.m1jpIcYcJiHLE2Gtd-XEkCzMTl3wi1SJx5BXpD-Zogm7Po7Sy7yDK9jrX7MTOfOFofekVSbeluXw4mwJrcM_OTlTewrDVGMIZbd1RQ4fjI9C10dy60lL9ECDnx8V_iY_10GRXDuzt9KpO8FHwf4NEZ23Lfqp-FKeeb3ZImzXr2wpEfJSIF3ituCdp59Y4wi7s2OU4vPuzAPlp13h03VsbebtU3cfJUZVUuBLcb4HFvW8TLTowqo2XJ7HGap-IS2KQSXeNW6i_Cmzj0iCwGUdnEHNq2ajk2bssx-xbSpDKvtGrQZagTZ3mTdOu01A9NbVgGN0SYGL59ay1ljNvAqXNQ','expires_in': 3599,'token_type': 'Bearer'}"""

问题分析与修正方案 #

1. Scope参数格式错误：Autodesk OAuth的client_credentials模式中，scope必须是空格分隔的字符串，而非列表。原代码用列表传递会导致权限参数不被正确解析，即便拿到token也会因权限不足返回403。
   修正示例：

   'scope': 'code:all data:search data:write account:read user:read'
   

2. URL路径错误：get_autodesk_usage_summary中的URL错误保留了占位符冒号，API无法识别该路径，导致请求方法不匹配（405）或资源不存在（间接引发403）。需直接将合同编号拼接进URL。

3. 冗余认证设置：函数中同时设置了Authorization请求头和Session的OAuth2BearerToken认证，虽不冲突但建议统一方式，比如仅保留请求头即可，避免冗余。

内容的提问来源于stack exchange，提问作者RobZ