HTTP Request Trigger Authentication

[AndyBradford]

I am putting together a flow where my external Asset Management System (Cartegraph) sends a webhook request to Power Automate to begin a Flow. When I test the webhook system, with the URL to the HTTP Request trigger, it says

(Response Code:Unauthorized) {"error":{"code":"AuthorizationFailed","message":"The authentication credentials are not valid."}}

I had a screenshot of the Cartegraph webhook interface, but the forum ate it. The Cartegraph Webhook interface contains the following fields:

URL (Text box)

Use Basic Authentication (checkbox)

Username (Text box)

Password (Text box)

"Test" Button
Test Status dialog

What authentication do I need to put in so Power Automate sees Cartegraph's request as valid? Using my Microsoft account credentials to authenticate seems like bad practice. 

[PrasadAthalye]

HTTP Trigger generates a URL with an SHA signature that can be called from any caller. Can you try calling the same URL from Postman?

[AndyBradford]

I don't have Postman, but I built a Python script to send a POST request without authentication. The JSON package kinda looked like what Cartegraph would send, and it hit some issues with being a valid JSON, but didn't get any authentication issues.

[PrasadAthalye]

That is correct. You shouldn't be getting authentication issues since the signature is included. You can actually paste the URL in Browser and it will invoke the flow. Since this is a risk, I added extra validation inside the flow to reject if the caller is not the one I expected...

[AndyBradford]

I plan to stick a security token into the flow as in: https://demiliani.com/2020/06/25/securing-your-http-triggered-flow-in-power-automate/ but the authentication issues are happening without it.

Is there a URL I can send a Cartegraph request to, to see what the request looks like, and see if Cartegraph is doing something silly - maybe attaching my Cartegraph user credentials?

[AndyBradford]

I plan to stick in a security token like in this: https://powerusers.microsoft.com/t5/Building-Flows/HTTP-Request-Trigger-Authentication/m-p/808054#M1... but the authentication issues happen without it.

Is there a way to catch and examine the Cartegraph request, so I can see if Cartegraph is doing something silly to the request, like adding my Cartegraph user credentials?

[PrasadAthalye]

You can install fiddler to trace the request...