Submit Request Form via API?
Hi,
I was wondering if the v3 API supports submission of Help Request Forms (https://help.wrike.com/hc/en-us/articles/209603169-Request-Forms). I couldn't find anything about it in the (otherwise excellent) API documentation.
Here's the problem I'm trying to solve:
Naomi has a Wrike folder she uses to track issues with widgets. She wants Jake to be able to create tasks in her folder, but not have access to it himself. Right now, they use the Request Forms to do this, but filling out the form by hand is slow.
I writing an app to help them, using the API to create tasks. Unfortunately, I'm still stuck over the permissions. If Joe logs into my app, he doesn't have access to the folder. If Naomi logs into my app, my app gets access to her entire account. The Request Forms feature seems ideal, but I don't know how to submit them via the API.
Thanks for any help or suggestions you can provide.
Daniel
So I just found an old post I made that I had forgotten about, where Pavel M recommended the "external" Request Form feature. I'll look into that and try it out, and see if it meets my needs.
https://help.wrike.com/hc/en-us/articles/209603169-Requests#external
Looks like the external Requests feature doesn't work either, because it requires a CAPTCHA.
Hi, Daniel! Thanks for posting your questions here!
Currently, there's no API method to submit a Request form. The solution may be to create a separate user and use it as an API bot. Give this user access to the necessary Folders/Projects and issue a permanent access token for it. This is the best way to go besides the Request forms.
On the other hand, could you please clarify how API makes things easier for you in this particular case? Right now it seems the approach with the external Request forms is the most viable option.
Hi Serge, thanks for the reply.
Creating an API bot user is definitely one option we are considering. The downside is that then anyone who works on the source code for the app (and thus has access to the permanent access token) effectively has access to all folders that the API bot user does. If the application is a native application whose source code can be disassembled, this means multiple API bots may be required, each with carefully-controlled permissions.
I am trying to use the API in this case because it's much easier for my software to fill out the form than for the user to do it by hand.
Imagine you are auditing a warehouse using an app running on a tablet. The app displays all the items that should be on each shelf location (as tracked by a database). As you walk past a shelf, you notice an item is missing.
With the request forms, you must pull up Wrike, select the appropriate form, fill in the shelf number, the item number, the item description, and the date and time you noticed the item was missing.
All this information is already present in the app. With a simple click of a button marked "Report as Missing", the app could fill out the request form and submit it much more easily and accurately.
Of course, the app could also create the task from scratch, rather than using the Request Form. However, then the app user must have access to the folder. This might be undesirable; for example, an unscrupulous auditor might begin stealing items from the warehouse, and then deleting the missing items reports before their crimes were discovered.
I understand that there are pitfalls in allowing automated creation of tasks in folders that a user does not have access to, but I think there are compelling reasons to allow it.
One possibility would be an API call that simply used WrikeBot to add the task to the appropriate folder.
e.g.
App calls API and creates new (private) task, with title, body, etc. Task is created.
App calls API with the Task ID and a new Folder ID (one that the user does not have access to)
The API shares the Task with Wrike Bot, then engages Wrike Bot to add the Task to the Folder specified by Folder ID.
This would avoid a complex API call to submit a request form, but still allow the same functionality, and could re-use the existing functionality of Wrike Bot (used by the Request Forms).
We dealt with this problem by creating an Apache Reverse Proxy that auto inserts the appropriate token in the headers. App Developers make calls on the reverse proxy without any knowledge of the token and it all works. Then all that needs to be done is control on what the App users have access to. The reverse proxy can be a seperate piece of infrastructure which can be as tightly controlled as you wish.