feat(assets): add support for AllowDirectApiAccess (#1722)

Author: GabrielVasilescu04

packages/uipath-platform/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uipath-platform"
-version = "0.1.65"
+version = "0.1.66"
 description = "HTTP client library for programmatic access to UiPath Platform"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.11"

packages/uipath-platform/src/uipath/platform/orchestrator/_assets_service.py

@@ -283,13 +283,55 @@ async def retrieve_async(
         else:
             return Asset.model_validate(response.json()["value"][0])
 
-    def _ensure_robot_context(self) -> None:
+    def _resolve_robot_key(
+        self,
+        name: str,
+        *,
+        folder_key: Optional[str] = None,
+        folder_path: Optional[str] = None,
+    ) -> Optional[str]:
+        """Return the robot key, or ``None`` if the asset opts into direct API access.
+
+        Raises ``ValueError`` when no robot key is available and ``AllowDirectApiAccess``
+        is not enabled on the asset.
+        """
         try:
-            is_user = self._execution_context.robot_key is not None
+            robot_key = self._execution_context.robot_key
         except ValueError:
-            is_user = False
-        if not is_user:
-            raise ValueError("This method can only be used for robot assets.")
+            robot_key = None
+
+        if robot_key is None:
+            asset = self.retrieve(
+                name=name, folder_key=folder_key, folder_path=folder_path
+            )
+            if not asset.allow_direct_api_access:
+                raise ValueError(
+                    f"No robot key available and 'AllowDirectApiAccess' is disabled for asset '{name}'."
+                )
+        return robot_key
+
+    async def _resolve_robot_key_async(
+        self,
+        name: str,
+        *,
+        folder_key: Optional[str] = None,
+        folder_path: Optional[str] = None,
+    ) -> Optional[str]:
+        """Async variant of :meth:`_resolve_robot_key`."""
+        try:
+            robot_key = self._execution_context.robot_key
+        except ValueError:
+            robot_key = None
+
+        if robot_key is None:
+            asset = await self.retrieve_async(
+                name=name, folder_key=folder_key, folder_path=folder_path
+            )
+            if not asset.allow_direct_api_access:
+                raise ValueError(
+                    f"No robot key available and 'AllowDirectApiAccess' is disabled for asset '{name}'."
+                )
+        return robot_key
 
     @resource_override(resource_type="asset")
     @traced(
@@ -305,6 +347,10 @@ def retrieve_credential(
         """Get the decrypted password of a Credential asset.
 
         The robot id is retrieved from the execution context (`UIPATH_ROBOT_KEY` environment variable).
+        If no robot key is available, the asset's `AllowDirectApiAccess` flag is checked: when
+        enabled, the credential is fetched without a robot key; otherwise a `ValueError` is raised.
+
+        Related Activity: [Get Credential](https://docs.uipath.com/activities/other/latest/workflow/get-robot-credential)
 
         Args:
             name (str): The name of the credential asset.
@@ -315,10 +361,18 @@ def retrieve_credential(
             Optional[str]: The decrypted credential password.
 
         Raises:
-            ValueError: If called outside a robot context (no `UIPATH_ROBOT_KEY`).
+            ValueError: If no robot key is available and the asset does not have `AllowDirectApiAccess` enabled.
         """
-        self._ensure_robot_context()
-        spec = self._retrieve_spec(name, folder_key=folder_key, folder_path=folder_path)
+        robot_key = self._resolve_robot_key(
+            name, folder_key=folder_key, folder_path=folder_path
+        )
+
+        spec = self._retrieve_credential_spec(
+            name,
+            robot_key=robot_key,
+            folder_key=folder_key,
+            folder_path=folder_path,
+        )
         response = self.request(
             spec.method,
             url=spec.endpoint,
@@ -343,6 +397,10 @@ async def retrieve_credential_async(
         """Asynchronously get the decrypted password of a Credential asset.
 
         The robot id is retrieved from the execution context (`UIPATH_ROBOT_KEY` environment variable).
+        If no robot key is available, the asset's `AllowDirectApiAccess` flag is checked: when
+        enabled, the credential is fetched without a robot key; otherwise a `ValueError` is raised.
+
+        Related Activity: [Get Credential](https://docs.uipath.com/activities/other/latest/workflow/get-robot-credential)
 
         Args:
             name (str): The name of the credential asset.
@@ -353,10 +411,18 @@ async def retrieve_credential_async(
             Optional[str]: The decrypted credential password.
 
         Raises:
-            ValueError: If called outside a robot context (no `UIPATH_ROBOT_KEY`).
+            ValueError: If no robot key is available and the asset does not have `AllowDirectApiAccess` enabled.
         """
-        self._ensure_robot_context()
-        spec = self._retrieve_spec(name, folder_key=folder_key, folder_path=folder_path)
+        robot_key = await self._resolve_robot_key_async(
+            name, folder_key=folder_key, folder_path=folder_path
+        )
+
+        spec = self._retrieve_credential_spec(
+            name,
+            robot_key=robot_key,
+            folder_key=folder_key,
+            folder_path=folder_path,
+        )
         response = await self.request_async(
             spec.method,
             url=spec.endpoint,
@@ -379,6 +445,8 @@ def retrieve_secret(
         """Get the decrypted value of a Secret asset.
 
         The robot id is retrieved from the execution context (`UIPATH_ROBOT_KEY` environment variable).
+        If no robot key is available, the asset's `AllowDirectApiAccess` flag is checked: when
+        enabled, the secret is fetched without a robot key; otherwise a `ValueError` is raised.
 
         Args:
             name (str): The name of the secret asset.
@@ -389,10 +457,18 @@ def retrieve_secret(
             Optional[str]: The decrypted secret value.
 
         Raises:
-            ValueError: If called outside a robot context (no `UIPATH_ROBOT_KEY`).
+            ValueError: If no robot key is available and the asset does not have `AllowDirectApiAccess` enabled.
         """
-        self._ensure_robot_context()
-        spec = self._retrieve_spec(name, folder_key=folder_key, folder_path=folder_path)
+        robot_key = self._resolve_robot_key(
+            name, folder_key=folder_key, folder_path=folder_path
+        )
+
+        spec = self._retrieve_credential_spec(
+            name,
+            robot_key=robot_key,
+            folder_key=folder_key,
+            folder_path=folder_path,
+        )
         response = self.request(
             spec.method,
             url=spec.endpoint,
@@ -415,6 +491,8 @@ async def retrieve_secret_async(
         """Asynchronously get the decrypted value of a Secret asset.
 
         The robot id is retrieved from the execution context (`UIPATH_ROBOT_KEY` environment variable).
+        If no robot key is available, the asset's `AllowDirectApiAccess` flag is checked: when
+        enabled, the secret is fetched without a robot key; otherwise a `ValueError` is raised.
 
         Args:
             name (str): The name of the secret asset.
@@ -425,10 +503,18 @@ async def retrieve_secret_async(
             Optional[str]: The decrypted secret value.
 
         Raises:
-            ValueError: If called outside a robot context (no `UIPATH_ROBOT_KEY`).
+            ValueError: If no robot key is available and the asset does not have `AllowDirectApiAccess` enabled.
         """
-        self._ensure_robot_context()
-        spec = self._retrieve_spec(name, folder_key=folder_key, folder_path=folder_path)
+        robot_key = await self._resolve_robot_key_async(
+            name, folder_key=folder_key, folder_path=folder_path
+        )
+
+        spec = self._retrieve_credential_spec(
+            name,
+            robot_key=robot_key,
+            folder_key=folder_key,
+            folder_path=folder_path,
+        )
         response = await self.request_async(
             spec.method,
             url=spec.endpoint,
@@ -559,6 +645,32 @@ def _retrieve_spec(
             },
         )
 
+    def _retrieve_credential_spec(
+        self,
+        name: str,
+        *,
+        robot_key: Optional[str],
+        folder_key: Optional[str] = None,
+        folder_path: Optional[str] = None,
+    ) -> RequestSpec:
+        body: Dict[str, Any] = {
+            "assetName": name,
+            "supportsCredentialsProxyDisconnected": True,
+        }
+        if robot_key is not None:
+            body["robotKey"] = robot_key
+
+        return RequestSpec(
+            method="POST",
+            endpoint=Endpoint(
+                "/orchestrator_/odata/Assets/UiPath.Server.Configuration.OData.GetRobotAssetByNameForRobotKey"
+            ),
+            json=body,
+            headers={
+                **header_folder(folder_key, folder_path),
+            },
+        )
+
     def _update_spec(
         self,
         robot_asset: UserAsset,

packages/uipath-platform/src/uipath/platform/orchestrator/assets.py

@@ -47,6 +47,9 @@ class UserAsset(BaseModel):
     connection_data: Optional[CredentialsConnectionData] = Field(
         default=None, alias="ConnectionData"
     )
+    allow_direct_api_access: Optional[bool] = Field(
+        default=None, alias="AllowDirectApiAccess"
+    )
     id: Optional[int] = Field(default=None, alias="Id")
 
 
@@ -73,3 +76,6 @@ class Asset(BaseModel):
     secret_value: Optional[str] = Field(default=None, alias="SecretValue")
     external_name: Optional[str] = Field(default=None, alias="ExternalName")
     credential_store_id: Optional[int] = Field(default=None, alias="CredentialStoreId")
+    allow_direct_api_access: Optional[bool] = Field(
+        default=None, alias="AllowDirectApiAccess"
+    )