i have a python script that attempts to get assignments using the graphql API and replicating the request send when you klick the execute button (note we neither can nor will ever use oath2 because we do not have the resources to get verified )
#!python
import browser_cookie3
import requests
import json
cj = browser_cookie3.chromium(domain_name='iusd.instructure.com')
print(cj)
def send(cj):
token = None
for i in cj:
if "<Cookie _csrf_token=" in str(i):
token = str(i).replace("<Cookie _csrf_token=","").replace(" for iusd.instructure.com/>","")
url = "https://iusd.instructure.com/api/graphql"
headers = {
"accept": "application/json+canvas-string-ids, application/json, text/plain, */*",
"accept-language": "en-US,en;q=0.9",
"baggage": "sentry-environment=Production,sentry-release=canvas-lms@20250409.326,sentry-public_key=355a1d96717e4038ac25aa852fa79a8f,sentry-trace_id=a62f30e1b8bc4d8bbedaa00fb431462d",
"content-type": "application/json",
"priority": "u=1, i",
"sec-ch-ua": "\"Chromium\";v=\"133\", \"Not(A:Brand\";v=\"99\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"Linux\"",
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "same-origin",
"sentry-trace": "",
"x-csrf-token": token,
"x-requested-with": "XMLHttpRequest"
}
# GraphQL query
query = """
{
allCourses {
name
_id
submissionsConnection(filter: {states: submitted}) {
nodes {
gradingStatus
submissionStatus
submittedAt
state
assignment {
_id
name
}
user {
_id
name
sisId
email
enrollments {
state
course {
_id
}
}
}
}
}
term {
sisTermId
name
}
}
}
"""
payload = json.dumps({
"query": query,
"variables": None
})
try:
response = requests.post(url, headers=headers, data=payload,cookies=cj)
print(response.request.headers)
response.raise_for_status() # Raises an HTTPError if the response code was unsuccessful
print(response.json())
return response
except requests.exceptions.HTTPError as errh:
print(f"HTTP Error: {errh}")
except Exception as e:
print(f"An error occurred: {e}")
if __name__ == "__main__":
send(cj)
the current code uses browser_cookie3 to gain all the cookies from a canvas instance (in this case a institution i am part of) and then it attempts to list assignments however we get a 422 error.
i understand that the csrf token refreshes after each request but this was after the last request was in browser. we need the data to create a todolist and no asking our clients to generate devkeys is not going to cut it
HTTP Error: 422 Client Error: Unprocessable Entity for url: https://iusd.instructure.com/api/graphql
