Here are the defect corrections and enhancements for the 7/13/2012 API release.    Summary Description Error message displayed during OAuth flow when using invalid API key When attempting an OAuth flow with an invalid API key, a difficult to read error message can be displayed. We fixed this so that the error message is now friendlier.         ... View more

Here are the defect corrections and enhancements for the 6/8/2012 API release.   Summary Description WebService Schedule Campaign - Cannot Schedule a Campaign for an SO An issue arose with a related defect correction that was preventing legitimate users from sending campaigns. This has been corrected so that users and applications can send campaigns correctly through the APIs. Facebook JMML app v2 We delivered a new version of our Facebook JMML app that uses the latest Facebook technology, uses OAuth 2 to authenticate with Constant Contact, and that improves the configuration and usability of the app. Welcome Back' message not needed on login page for OAuth authentication We recently rolled out our new login page (login.constantcontact.com). When entered through an OAuth flow, there is no need for the 'Welcome Back' message, so we disabled that message in this case. Auth app cannot be iframed. Previously, it was possible to iframe the auth app (login.constantcontact.com), which is used a part of OAuth authentication flows. This violates basic security considerations, as iframed login pages are easily spoofed. The Auth app starting with this release can no longer be iframed. Developers using OAuth flows inside of iframes should change their app to remove the iframe and have the auth flow run in a separate browser window or tab. ... View more

Here are the significant changes and/or defect corrections that were made available in the 5/7/2012 Constant Contact API release:   Summary Description API: 500 ERROR upon update of Contact in Visitor status Only large list customers Fixed to avoid 500 error in this valid case. OAuth2 flow returns error 500 when using parameter redirect_url instead of redirect_uri. Fixed to return a more appropriate error message: 400 : A redirect_uri parameter must be supplied. Hootsuite gives 403 error always The Hootsuite integration was returning a 403 always. There was a configuration problem in the Hootsuite app that has been resolved. Users will now correctly see the login page (if they have not yet authenticated) or their streams (if they are already authenticated). Hootsuite Help URL is incorrect The Help URL for the HootSuite APP is incorrect. App was updated to show correct help URL: http://help.hootsuite.com/forums/20406882-constant-contact-app-faqs Error page when new SO choose 'cancel' in the key creating page On the API key page on developer.constantcontact.com, if an SO who has 0 API keys hits the 'Cancel' link, a 500 error used to occur. We fixed this by always displaying the API list page, even if there were no keys in the list. We added a message "You have no existing API keys" so that the user could interpret the page properly. WebService Schedule Campaign - Cannot Schedule a Campaign for an SO Previously, there were cases where an SO could not schedule a campaign via the external Campaigns API. This was traced to an issue with case-sensitive compare between the SO name as provided in the API URI and the SO name as stored in our database. The compare is now case-insensitive, which resolved the issue. ... View more

Here are the release notes from the 2/20/2012 Constant Contact API release.     Summary Description Response code should be 404 instead of 400 while trying to retrieve Event details for a non existent Event Previously an attempt to GET an Event that does not exist would return a 400 error. This is incorrect - the correct error code is 404, which is now being returned. Blogs - Cannot Save Campaign when Inserting Blogs into a block when setting Yes to "Do you want to delete block contents before inserting?" When using the RSS editor block, if the user responded Yes to the question on deleting existing block content, it was impossible to save the campaign. This has been corrected and campaigns can now be saved. Entering a space " " in statecode OR countrycode allows bad data in to the database causing 400 errors Space characters in statecode or countrycode were causing 400 errors when adding contacts. This was corrected to trim space before adding contacts.   ... View more

Here are the significant changes and/or defect corrections that were made available in the 3/30/2012 Constant Contact API Release: Summary Description User with locked account is able to authenticate via OAuth Previously a user whose account had been locked was able to authenticate and access protected resources via an OAuth authentication flow. This represented a security hole. The behaviour has been changed to ensure that a locked user is not allowed to login via OAuth. GET on image list occasionally returns 406 error Calls to the Library API to GET an image list (of the form /library/folders/<folderID>/images) were intermittently returning a 406 error when no AcceptHeader was added to the call. The correct behavior is to return 404 if any header other than ATOM+XML is sent. This includes the case of an empty header (which will now correctly return 404). OAuth 1.0a deny access leaves user stuck on the deny access page If a user clicks the 'Deny Access' button in an OAuth 1.0a authentication flow, they are directed to an error page. This page has several problems. First, there is a typo in the error message. Second, the instructions in the error message tell the user to close the window to return to their application. However, closing the window does nothing. We have changed the 'deny access' flow to append a 'oauth_error=user_denied_access' parameter and value to the callback URL. Programmers can now check the URL parameters in their callback handler - if the 'oauth_error' parameter is found, the user has denied access and the programmer can act accordingly.   ... View more

Here are the significant changes and/or defect corrections that were made available in the 1/17/2012 Constant Contact API release:   Summary Description OAuth grant access page has typographical error OAuth grant access page spells "persistent" as "perisistent". We corrected this typo. OAuth 2 flows must not set session cookie In our OAuth 2 implementation, a successful authentication was setting an SSO cookie in the browser. This was subjecting any web-based integration applications to a session timeout. We changed the behaviour so that the SSO cookie is no longer set. OAuth flows should allow a user to login to a given application from multiple devices. Previously when a user initiated an OAuth flow, any existing tokens (for both OAuth 1 and 2) were invalidated and new ones generated and returned to the calling application. This made it impossible for a user to run the same app on two devices. This behaviour was changed to return the same tokens for any subsequent logins. Getting 500 error when tring to retrieve tracking data for a non existent campaign Previously when attempting to GET the tracking data from the campaigns collection, API users would receive a 500 error. This has been changed to return a 400 error. API: 500 error when creating campaign Creating a campaign would return a 500 error when the values in the <IncludeForwardEmail> or <IncludeSubscribeLink> tags were in lower case. We changed this behaviour so that the values could be in mixed case, as in YES, yes, Yes, etc. Updating Contacts incorrectly returns 400 error when domain name contains case mismatch When updating a Contact via the API, a 400 error was returned when the case of the email address domain does not match the case stored for this contact in the user's account, even if the email address is still the same. We changed this behaviour to ignore the case of the domain portion of the email address when updating a contact. Create Campaign - Lower Case value is not accepted for the EmailContentFormat attribute Previously when creating an Email campaign via the APIs, the EmailContentFormat value would only accept a lower case value. Any other case would generate a '400 - Bad Request' error. This was corrected so that the value is now case insensitive. ... View more

Here are the significant changes and/or defect corrections that were made available in the 12/2/2011Constant Contact API release:   Summary Description Replace PHP wrapper on website with latest version We have updated our PHP wrapper library to use the latest version. This includes better documentation and an easier programming model. Return username as parameter in OAuth2 server flow Previously our OAuth 2 server flow did not return the Constant Contact username. We have added a new parameter 'username' that contains the username (as a string), that is returned in the intermediate step in the OAuth 2 server flow (the same step where the 'code' parameter is returned'. Programmers should process the URL parameters in their callback routine to obtain the username (which is required for formulating URLs to the user data). Support for logout in OAuth flows When using OAuth via a web based application, the Constant Contact user is authenticated as part of the OAuth flow. We made a change to ensure that if a subsequent OAuth flow is initiated, the current user is logged out. This allows a different user to authenticate to their OAuth applcation. Incorrect error code when retrieving image list Previously an attempt to GET the list of images from the Library api will fail with a 404 error if 'application/xml' was used as the accept type in the accept header. Since 'application/xml' is not a supported type for image lists, we have changed the error message to a 406 when this accept header type is used.  Campaign create with missing <EmailTextContent> node returns ambiguous 400 error. When creating a campaign, if the <EmailTextContent> node is not supplied, the following error will be returned: "Error 400: You must have content for your letter". This is the same error that is returned when the <EmailContent> node is not supplied. We have changed the error text to now read: "Error 400: Invalid or Missing <EmailTextContent>". Error 500 returned when attempting to retrieve campaing stats for a non-existent campaign. When attempting to GET campaign stats from the campaigns collection (for example, for a URI of the form campaigns/12345/events/sends) on a non-existent campaign, a 500 error is returned. We have changed this to return a 404 error with error text indicating that the campaign does not exist. Retrieving campaign stats for a draft campaign returns a 403. When attempting to GET campaign stats from the campaigns collection (for example, for a URI of the form campaigns/12345/events/sends) on a draft campaign, a 403 error is returned. We have changed this to return a 404 error with error text indicating that tracking data does not exist for the campaign. Attempt to GET a registrant list can return 500 error Under certain conditions, a GET on a registrant list for an event can return a 500 error if the event does not exist in the customer account. This has been changed to return a 404 error with an appropriate error message.   ... View more

Here are the significant changes and/or defect corrections that were made available in the 10/28/2011Constant Contact API release:   Summary Description Setting accept header to empty casues 500 upon performing GET on events A bug in the Events resource was causing a 500 error to be returned when performing a GET on /events. This has been corrected so that and empty accept header is allowed and returns the default XML format. @ symbol in user name causes 400 error when doing a GET on Export Activity File Link The @ symbol is an allowed character in Constant Contact user names, so this defect was corrected so that the GET on Export Activity File link no longer fails with a 400 error. Version 2.1 of QuickBooks Info Transfer is available This new version fixes several defects and also provides support for QB2011 and QB2012. See the related FAQ here. Create a contact list without any Name element causing 500 error The <Name> element is required for a POST to the contacts lists collection. A missing Name element should not generate a 500 error. This was corrected and a new error message "400: No valid Contact List Name found in entry content" is now returned. UX responsiveness changes for oauth app Previously the Constant Contact login page and the OAuth grant access page did not correctly respond to changes in the form factor of the displaying browser. This made these pages difficult to use, especially on mobile devices. These pages were re-styled so that they are responsive to changes in device form factor. ... View more

  Here are the significant changes and/or defect corrections that were made available in the 9/23/2011 Constant Contact API release:   Summary Description Perform Get on REST resources using invalid accept header gives 404 instead of 406 Certain REST resources (Templates, SiteOwner) will return a 404 error when a GET request is made that does not include a valid accept header. This is incorrect. The proper return code is a 406. Programmers should ensure to add a valid accept header to all such requests. Additionally, programmers should check for a 406 error instead of checking for a 404 error in their error handling routines. OAuth 1.0a: Update implementation to use login.constantcontact.com for credentials verification Constant Contact is standardizing on a single authentication application (login.constantcontact.com) for all applications. Accordingly, our OAuth 1.0a implementation now used this application for credentials verification as part of the token flow. This should have no impact on programmers, but end users will notice that the login page is now different. Create Folder with No Name element gives 500 error When attempting a POST operation to create a new Folder, the operation fails with a 500 error if the XML contains an empty or missing 'Name' element. This is incorrect behavior. This has been fixed so that the error code is now a 400, with an error message of the form "Your are missing the following required elements: [Name]". Production Issue: MIME type support for Adobe .air When attempting to download the Contact Capture Tool, a bug in the HTML page caused the download to fail because the MIME type (Adobe .air file) was not supported. This has been corrected and the Contact Capture Tool can now be successfully downloaded. Add field length checking for Contact Add and Update Apis Previously when issuing POST or PUT operations on Contacts via the contacts REST API, field lengths were not being checked. This caused 500 errors to be returned with stack traces. The behavior has been fixed. Fields that are too long or missing will now return 400 errors with the problem fileds listed in the error text. ... View more

Greetings, Constant Contact developers!       For those of you who are Java programmers, I am pleased to announce that scribe-java, the most-used open source Java OAuth library, now has support for Constant Contact. I had written the original implementation and worked with the owner of the project on github to include my changes, which he has recently done. If you are interested, login to your github account (you do have a github account, don't you? :smileywink and check out the project at: https://github.com/fernandezpablo85/scribe-java.           With scribe-java, obtaining OAuth access tokens and making REST calls to obtain protected resources is very straight-forward. For example, let's say you wanted to search for a contact by email address. If you already have an access token, you can do this in a few lines of code:           // Create the service      OAuthService _service = new ServiceBuilder() .provider(ConstantContactApi.class) .apiKey(apiKey) .apiSecret(apiSecret) .build();   // Assuming userName and email are string variables with appropriate values String serviceURI = "https://api.constantcontact.com/ws/customers/" + userName + "/contacts?email=" + email; OAuthRequest getContactRequest = new OAuthRequest(Verb.GET, serviceURI); _service.signRequest(_accessToken, getContactRequest); Response getContactResponse = getContactRequest.send(); String contactEntry = getContactResponse.getBody();     That's it. The contactEntry now has the XML for the contact and you're ready to parse it. If you're still doing OAuth Java by hand, stop it now! Download scribe-java with its new support for Constant Contact and save yourself some time and headaches. And stay tuned for more sample code designed to help you with common coding tasks using Java and Constant Contact.   Happy Coding! Matthew D. Laudato Product Manager, Integrations, APIs and Web Services Constant Contact, Inc.                                                                     ... View more