User and pass from API

Question

EDIT
This question was for a workaround. Getting a successful login by using HttpWebRequests. Not on how to use the api.

Question
I noticed in the API there was no way to get a usernames password.

This is what I have now as a test. I thought I could just get the "Wrong user/pass" response first and go from there. All I get is the pages source code.

Anyone have any pointers or advice?

I am definitively logging in. In Account Admin and Login History, it shows me logging in. But the server is not serving any useful response text for the login. And now, I locked myself out using wrong passwords to sort through the streamreader lol.

public string DoVerification(string email, string password)
    {
        var request = (HttpWebRequest)WebRequest.Create("https://app.smartsheet.com/b/home");

        var postData = "loginEmail=" + email;
        postData += "&loginPassword=" + password;
        postData += "&action=login";
        var data = Encoding.ASCII.GetBytes(postData);

        request.Method = "POST";
        request.ContentType = "application/x-www-form-urlencoded";
        request.ContentLength = data.Length;

        using (var stream = request.GetRequestStream())
        {
            stream.Write(data, 0, data.Length);
        }

        var response = (HttpWebResponse)request.GetResponse();

        return new StreamReader(response.GetResponseStream()).ReadToEnd();
    }

    private void btnLogin_Click(object sender, EventArgs e)
    {
        string response = DoVerification("[email protected]", "12345");
        MessageBox.Show(response.ToString());
    }

Answer 1

After comparing both sources from the returned response.

I have these two js functions.

Failed attempt

function loggedFailures() {
    logExternalGTMEvent({'event': 'app-login-failure','method': 'onsite','error': 'AUTH_NO_MATCHING_USER'}); return true
}

Successful attempt

function loggedFailures() {
    return false
}

I just simply check for one or the other.

And for the record, putting the users password in the api is not a bad idea.... Smartsheets lets us delete any user through the API, so I don't see what it would matter.