Accessing the `student_view_url` via Open Edx API authentication or alternatives?

Question

I’m working on a React Native application where all the Edx course information needs to be displayed offline.

I’ve authenticated the app using oauth2 endpoint (client_id=…&grant_type=password&[email protected]&password=p455w0rd to {{root}}/oauth2/access_token/) and can access the API endpoints to get the users enrolled courses ({{root}}/api/enrollment/v1/enrollment) and the blocks within those courses ({{root}}/api/courses/v1/blocks/?course_id={{course_id_url_friendly}}&depth=all&nav_depth=3&return_type=list&username={{username}}). What I’m struggling to get is the contents of the HTML blocks.

I see in the official app (when viewing requests via a proxy) that it will request the actual webpage of the course, presumably the student_view_url.

Is this the only way to get that content or is there an API endpoint I can use to return the content?

If the only way is to request the rendered student_view_url, how do I access that page? The only way I can tell in the official app is it looks like it’s passing the cookies to authenticate with the studen_view_url, which it must get when it authorises the user via the oauth2 endpoint. The cookies I get don’t work though, which I’ve tested in Postman (if I use cookies that I got from browsing my Edx site in Chrome, they do work). This begs me the question, is my authentication correct as I don’t get any scope returned when the official app returns a scope filled in with read write and two others.

A sample of what my authentication returns:

{ "access_token": "a12345...", "token_type": "Bearer", "expires_in": 2591999, "scope": "" }

To reiterate;

1. Is there a way to request the HTML content via the API (so returned in a JSON request) rather than the student_view_url

2. If not then how do I authenticate to access the student_view_url?

Answer 1

So I worked out how to do point 2.

Before requesting any HTML content you need to hit the endpoint {{root}}/oauth2/login/ with the auth token that you provide to other endpoints. This will pass back a usable sessionid cookie that will let you access content that's not public (so long as the user has access).

As an aside, to pass the cookie through fetch() requests, I had to pass the option credentials: 'include'.