cantaloupe-downloader/API.md

api-investigation.md — copied from kanban investigation task t_54f0a481

Key Findings

Architecture

• Seed (/login/) — Vue 3.5 SPA auth page
• Application (/cs1/, /cs4/) — ASP.NET MVC behind Azure Application Gateway
• Machine List page at /cs4/VueMachineList/ (modern SPA)

Auth Flow (httpx-compatible)

1. GET /login/api/DataContext/GenerateAntiForgeryState → CSRF token
2. POST /login/api/SignIn/SignIn/en-US with __RequestVerificationToken header + {Email, Password, FormsAuthReturnUrl}
3. Cookies are set automatically: ASP.NET_SessionId, .ASPXAUTH, ApplicationGatewayAffinity, AeonPrincipalCacheVersion

Export

• Endpoint: POST /cs4/VueMachineList/ExcelExport
• StreamSaver.js streams result as "Machine List.xlsx"
• 60+ configurable columns
• Credentials via env: CANTALOUPE_EMAIL, CANTALOUPE_PASSWORD

Recommendation

Start with httpx-only (Option A). Fall back to Playwright-for-login (Option B) if needed.

See full investigation at: ~/.hermes/kanban/boards/cantaloupe-downloader/workspaces/t_54f0a481/investigation-findings.md