# Request refresh via API

**URL:** <https://discourse.nodered.org/t/request-refresh-via-api/33008>\
**Category:** Feature Requests\
**Created:** [17 September 2020 17:52 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008 "2020-09-17T17:52:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![RaimondB](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/raimondb/32/3903_2.png) [@RaimondB](https://discourse.nodered.org/u/RaimondB)\
**Post date:** [17 September 2020 17:52 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008/1 "2020-09-17T17:52:35Z")

</div>

Hi,

I have been automating the maintenance of the modules I created so that dependencies are quickly updated and security issues prevented.

I now have a fully automated pipeline based on dependabot, snyk security checks, github actions, travis builds with testing and semantic release to publish to npm.

There is only 1 step missing: requesting the refresh on the node-red portal. I would love to automate that as well. Is there an API endpoint available for this or do you know of another way how I could signal the refresh in an automated way?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 September 2020 18:09 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008/2 "2020-09-17T18:09:58Z")

</div>

By node-red portal I assume you mean [https://flows.nodered.org](https://flows.nodered.org) ?

It is feasible to automate, but it isn't really setup to be done so.

A refresh can be triggered in two different ways

- one way is by clicking the 'request refresh' link in the sidebar. That will trigger an HTTP GET to `https://flows.nodered.org/node/<name of module>/refresh`.
- the other is submitting the 'add node' form - that will trigger an HTTP POST to `https://flows.nodered.org/add/node` with the `module` payload property set to the name of the module.

**However** , in both cases, the request must be from a logged in user, and must include a valid CSRF token. The CSRF token can be obtained by loading the /add/node page and scraping the token out of it. But getting a valid login session will be very hard to automate - it requires a browser-based flow against GitHub.

So, TLDR; it is probably quite a bit of work to do properly and may just be unfeasible with the current APIs.

To be honest, the API has been designed to provide some amount of protection against automated access - hence lots of CSRF token usage and needing to be logged in to do anything.

---

<div class="post-metadata">

**Author:** ![RaimondB](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/raimondb/32/3903_2.png) [@RaimondB](https://discourse.nodered.org/u/RaimondB)\
**Post date:** [17 September 2020 18:33 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008/3 "2020-09-17T18:33:54Z")

</div>

That is unfortunate. Would it also work if I provided a bearer token? Or do you require the token to be in a cookie?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 September 2020 18:44 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008/4 "2020-09-17T18:44:43Z")

</div>

> [@RaimondB](#):
>
> Would it also work if I provided a bearer token? Or do you require the token to be in a cookie?

It has to be a cookie - like I said, the site simply has not been built to facilitate automated access.

Not saying it couldn't be changed, but it isn't something on my todo list.

---

<div class="post-metadata">

**Author:** ![RaimondB](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/raimondb/32/3903_2.png) [@RaimondB](https://discourse.nodered.org/u/RaimondB)\
**Post date:** [17 September 2020 18:56 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008/5 "2020-09-17T18:56:53Z")

</div>

Ok, thanks for the quick response.  
I'll try out some things to see what I can do.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [16 November 2020 18:57 UTC](https://discourse.nodered.org/t/request-refresh-via-api/33008/6 "2020-11-16T18:57:07Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.