Access the Alexa Shopping and To-Do Lists with Python3 request module

Edit/Update July 2024:

As of July 1, 2024, the API is no longer valid and is deprecated. You are welcomed with this warning when visiting Access the Alexa Shopping and To-Do Lists

Warning: Starting July 1, 2024, you will no longer be able to use List skills or the List Management REST API to access Alexa lists, i.e., the Alexa Shopping and To-Do lists, in your skills or apps. For other ways to build custom voice experiences, see Steps to Build a Custom Skill. Please contact us if you have any questions.

The API usage described below from my original question for Amazon lists is deprecated and you will receive the following message when trying to use it:

API is deprecated. For more information visit https://developer.amazon.com/en-US/docs/alexa/ask-overviews/deprecated-features.html#shopping-lists'

In a nutshell, I am attempting to access my Amazon account's default Shopping List and To-Do List via Python [requests module](https://pypi.org/project/requests/). I feel like there must be a step that I am overlooking after attempting to follow the developer documentations on this topic. I went over the steps provided by the Alexa developer post *[Access the Alexa Shopping and To-Do Lists][1]* and here are small commentaries from my experience from the steps provided:

Configure permissions to access the Alexa lists in your skill.
This step was rather simple. I started with creating my custom skill as advised here, but I ended up actually making the skill provided here, so essentially only completing the fist two steps. Once the custom skill was created, I was able to enable the read and write permissions for the Skill (toggled Lists Read/Write), thus giving the skill list access.
Design a user intent model that uses customer Alexa lists.
This step I assume is skipped?? I did not see any reference to this step anywhere on the page besides the beginning.
Handling customer missing permissions.
I just went to my Alexa App and enabled access inside the settings of my custom "Dev" skill in this stage.
Get access the customer's Alexa lists.
Here I followed the steps for Out-of-session interaction and obtained "token". I believe this is Skill Messaging API Access Token?
Implement the list management capabilities in your skill service code.
This, I suppose, is where my disconnect is shown. After acquiring my token, I attempt to use the List Management REST API. The following Python code attempts to list out my current lists that I have with my client ID and secret values loaded from a json file in the same directory:

import requests
import json

def main():
    # Load client ID and Secret values
    with open("client_info.json", "r") as cred:
        clientInfo = json.load(cred)

    clientID = clientInfo["clientID"]
    clientSecret = clientInfo["clientSecret"]


    # Gettign token for api requests

    HEADERS = {
        "X-Amzn-RequestId": "d917ceac-2245-11e2-a270-0bc161cb589d",

        "Content-Type": "application/json"
    }

    DATA = {"client_id": clientID, "grant_type": "client_credentials",
            "client_secret": clientSecret, "scope": "alexa:skill_messaging"}

    url = "https://api.amazon.com/auth/o2/token"

    DATA = json.dumps(DATA)
    response = requests.post(url, data=DATA, headers=HEADERS)
    print("Response for token: %s " % response)
    info = json.loads(response.text)
    token = info["access_token"]


    # seeing a list of all lists

    endpoint = "https://api.amazonalexa.com"
    url = endpoint + "/v2/householdlists/"

    HEADERS = {
        "Authorization": "Bearer " + token,
        "Content-Type": "application/json",
        "Accept": "application/json"
    }
    new_response = requests.get(url, headers=HEADERS)

    print("Response for list info: %s " % new_response)
    print(new_response.text)


if __name__ == "__main__":
    main()

The print statements show the following

Response for token: <Response [200]> 
Response for list info: <Response [403]> 
{"Message":"Not all permissions are authorized."}

I am not sure if this is possible, or if there is a step that I have overlooked. Any help is much appreciated!

EDIT:

Following Christina's suggestions, I was able to obtain the userId and create a dummy message for the skill. However, the answer was empty yet returned a 202 response code.

import requests
import json

def main():
    # Load client ID and Secret values
    with open("client_info.json", "r") as cred:
        clientInfo = json.load(cred)

    clientID = clientInfo["clientID"]
    clientSecret = clientInfo["clientSecret"]
    ALEXA_USER_ID = clientInfo["userID"]

    # Getting token for api requests

    HEADERS = {
        "X-Amzn-RequestId": "d917ceac-2245-11e2-a270-0bc161cb589d",

        "Content-Type": "application/json"
    }

    DATA = {"client_id": clientID, "grant_type": "client_credentials",
            "client_secret": clientSecret, "scope": "alexa:skill_messaging"}

    url = "https://api.amazon.com/auth/o2/token"

    DATA = json.dumps(DATA)
    response = requests.post(url, data=DATA, headers=HEADERS)
    print("Response for token: %s " % response)
    info = json.loads(response.text)
    token = info["access_token"]

#######################################################################
    HEADERS = {
        "Authorization": "Bearer " + token,
        "Content-Type": "application/json",
    }

    # v_url = "https://api.amazon.com/auth/O2/tokeninfo"
    API_URL=f"https://api.amazonalexa.com/v1/skillmessages/users/{ALEXA_USER_ID}"
    a_data = {"data":{}, "expiresAfterSeconds": 60}
    a_data = json.dumps(a_data)
    a_response = requests.post(API_URL, data=a_data, headers=HEADERS)
    print("Response code: %s" % a_response)
    print(a_response.text)
    print("after response text")

if __name__ == "__main__":
    main()

Output:

Response for token: <Response [200]>
Response code: <Response [202]>

after response text

I believe the next step is for the Skill service to send acknowledgments to the Skill Messaging API, however I'm not sure how to accomplish this. Below is currently within my developer console along with the contents in my lambda_function.py:

# -*- coding: utf-8 -*-

# This sample demonstrates handling intents from an Alexa skill using the Alexa Skills Kit SDK for Python.
# Please visit https://alexa.design/cookbook for additional examples on implementing slots, dialog management,
# session persistence, api calls, and more.
# This sample is built using the handler classes approach in skill builder.
import logging
import ask_sdk_core.utils as ask_utils

from ask_sdk_core.skill_builder import SkillBuilder
from ask_sdk_core.dispatch_components import AbstractRequestHandler
from ask_sdk_core.dispatch_components import AbstractExceptionHandler
from ask_sdk_core.handler_input import HandlerInput

from ask_sdk_model import Response

logger = logging.getLogger(__name__)
logger.setLevel(logging.INFO)


class LaunchRequestHandler(AbstractRequestHandler):
    """Handler for Skill Launch."""
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool

        return ask_utils.is_request_type("LaunchRequest")(handler_input)

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response
        speak_output = "Welcome, you can say Hello or Help. Which would you like to try?"

        return (
            handler_input.response_builder
                .speak(speak_output)
                .ask(speak_output)
                .response
        )


class HelloWorldIntentHandler(AbstractRequestHandler):
    """Handler for Hello World Intent."""
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool
        return ask_utils.is_intent_name("HelloWorldIntent")(handler_input)

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response
        speak_output = "Hello World!"

        return (
            handler_input.response_builder
                .speak(speak_output)
                # .ask("add a reprompt if you want to keep the session open for the user to respond")
                .response
        )


class HelpIntentHandler(AbstractRequestHandler):
    """Handler for Help Intent."""
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool
        return ask_utils.is_intent_name("AMAZON.HelpIntent")(handler_input)

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response
        speak_output = "You can say hello to me! How can I help?"

        return (
            handler_input.response_builder
                .speak(speak_output)
                .ask(speak_output)
                .response
        )


class CancelOrStopIntentHandler(AbstractRequestHandler):
    """Single handler for Cancel and Stop Intent."""
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool
        return (ask_utils.is_intent_name("AMAZON.CancelIntent")(handler_input) or
                ask_utils.is_intent_name("AMAZON.StopIntent")(handler_input))

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response
        speak_output = "Goodbye!"

        return (
            handler_input.response_builder
                .speak(speak_output)
                .response
        )

class FallbackIntentHandler(AbstractRequestHandler):
    """Single handler for Fallback Intent."""
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool
        return ask_utils.is_intent_name("AMAZON.FallbackIntent")(handler_input)

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response
        logger.info("In FallbackIntentHandler")
        speech = "Hmm, I'm not sure. You can say Hello or Help. What would you like to do?"
        reprompt = "I didn't catch that. What can I help you with?"

        return handler_input.response_builder.speak(speech).ask(reprompt).response

class SessionEndedRequestHandler(AbstractRequestHandler):
    """Handler for Session End."""
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool
        return ask_utils.is_request_type("SessionEndedRequest")(handler_input)

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response

        # Any cleanup logic goes here.

        return handler_input.response_builder.response


class IntentReflectorHandler(AbstractRequestHandler):
    """The intent reflector is used for interaction model testing and debugging.
    It will simply repeat the intent the user said. You can create custom handlers
    for your intents by defining them above, then also adding them to the request
    handler chain below.
    """
    def can_handle(self, handler_input):
        # type: (HandlerInput) -> bool
        return ask_utils.is_request_type("IntentRequest")(handler_input)

    def handle(self, handler_input):
        # type: (HandlerInput) -> Response
        intent_name = ask_utils.get_intent_name(handler_input)
        speak_output = "You just triggered " + intent_name + "."

        return (
            handler_input.response_builder
                .speak(speak_output)
                # .ask("add a reprompt if you want to keep the session open for the user to respond")
                .response
        )


class CatchAllExceptionHandler(AbstractExceptionHandler):
    """Generic error handling to capture any syntax or routing errors. If you receive an error
    stating the request handler chain is not found, you have not implemented a handler for
    the intent being invoked or included it in the skill builder below.
    """
    def can_handle(self, handler_input, exception):
        # type: (HandlerInput, Exception) -> bool
        return True

    def handle(self, handler_input, exception):
        # type: (HandlerInput, Exception) -> Response
        logger.error(exception, exc_info=True)

        speak_output = "Sorry, I had trouble doing what you asked. Please try again."

        return (
            handler_input.response_builder
                .speak(speak_output)
                .ask(speak_output)
                .response
        )

# The SkillBuilder object acts as the entry point for your skill, routing all request and response
# payloads to the handlers above. Make sure any new handlers or interceptors you've
# defined are included below. The order matters - they're processed top to bottom.


sb = SkillBuilder()

sb.add_request_handler(LaunchRequestHandler())
sb.add_request_handler(HelloWorldIntentHandler())
sb.add_request_handler(HelpIntentHandler())
sb.add_request_handler(CancelOrStopIntentHandler())
sb.add_request_handler(FallbackIntentHandler())
sb.add_request_handler(SessionEndedRequestHandler())
sb.add_request_handler(IntentReflectorHandler()) # make sure IntentReflectorHandler is last so it doesn't override your custom intent handlers

sb.add_exception_handler(CatchAllExceptionHandler())

lambda_handler = sb.lambda_handler()

EDIT2: This is the only reference I've found for messaging.MessageReceived so far regarding python. Here is a similar SO post that is trying to communicate with Alexa skill via external app

Solution

You're missing a step between your step 4 and step 5. The token you got in step 4 is for calling Skill Messaging API, which is not tied to any user. You cannot use it to call the List Management REST API which is user specific.

First, you need to grab the userId of your account from your Skill Lambda (by invoking a LaunchRequest or IntentRequest). userId is persistent unless you disable/re-enable the skill.

Then, call Skill Messaging API with the token from step 4 and the userId to send a (dummy) message to your Skill, which allow you to pull the consentToken. Finally, call the list management API with the consentToken.

For reference, see step 2 in the Out-of-session interaction flow.

Update: For your follow-up question, the Messaging.MessageReceived request is an intent request. So similar to how you handle the other intents, just create a new handler for Messaging.MessageReceived, e.g.

class MessageReceivedHandle(AbstractRequestHandler):

    def can_handle(self, handler_input):
        return ask_utils.is_request_type("Messaging.MessageReceived")(handler_input)

    def handle(self, handler_input):
        logger.info("!!!!!!!!!!!!!!!!")
        logger.info(handler_input.request_envelope.context.system.user.permissions.consent_token)
        logger.info(handler_input.request_envelope.context.system.api_access_token)
        logger.info("!!!!!!!!!!!!!!!!")
        return None

And then register the new handler

sb.add_request_handler(MessageReceivedHandle())

I just log the token to CloudWatch, so after sending the dummy message via Skill Management API, you should see the token in CloudWatch and be able to use it for calling the list management API. Ideally you would store the token to something like dynamoDB (instead of CloudWatch) so your other script can read it (after sending the dummy message) and be able to query the todo lists.

Note: I'm logging both consentToken and apiAccessToken as they both are referenced in Alexa documentation. They should be the same, and you can use either one when calling the list management API.