API authentication to "create new subscriber"

[jcm-shove-it]

Is your feature request related to a problem? Please describe.

Currently the API documentation on adding subscribers might be misunderstood.

The example request is without authentication: https://listmonk.app/docs/apis/subscribers/#example-request_4:

curl 'http://localhost:9000/api/subscribers' -H 'Content-Type: application/json' --data '{"email":"subsriber@domain.com","name":"The Subscriber","status":"enabled","lists":[1],"attribs": {"city":"Bengaluru","projects":3,"stack":{"languages":["go","python"]}}}'

This seems correct as one can subscribe on the web form without authentication. Unfortunately, this call gives {"message":"Unauthorized"}.

On the other hand, the API doc states (https://listmonk.app/docs/apis/apis/):

API requests require BasicAuth authentication with the admin credentials.

Describe the solution you'd like

Wouldn't it make sense to allow adding subscribers without authentication? In our scenario, we need to add subscriptions from another web app. Currently I am using as a workaround a POST request found when checking the manual subscription web page: curl http://localhost:9000 -H 'application/x-www-form-urlencoded' --data 'email=email_localpart%40email_domain&nonce=&name=name&l=uuid_of_list', which is fully functional but a bit ugly.

Thanks for having a look at this, Joerg

[knadh]

Ah, looks like that curl example is missing the -u param. All /api/*, except for /api/public/* calls need authentication. Just fixed it in the docs.

[porterporter]

For me, POSTing /api/public/subscription still returns 401 { message: 'Unauthorized' }. Am I missing something or is this intended behavior?

[jcm-shove-it]

Ok, you updated the docs now to remove the misunderstanding, thanks. Still I am wondering why authentication is required to subscribe an email address to a list via json API while the authentication is not required to subscribe via POST of x-www-form-urlencoded?

Is there a reason this add subscription json API is not public?