API Permissions

[gtilles]

What I've noticed is that when certain settings are not allowed such as below, the API cannot do it either, the api should always have higher permission to perform these tasks.

If we want our SIS to be the authority source for pronouns, we should be able to not allow users to do it in Canvas but the api should still be able to set the values, or maybe the api should be able to change the setting, make the change and put it back to the original state.

Again, I believe authorized API calls should have elevated permissions over the user settings.

Users can delete their institution-assigned email address

Allow users to change their pronouns in Canvas

UPDATE:

This question is resolved, as of this morning the api call is working as it should, I had not tried it since we initially implemented the pronouns which was quite awhile ago.

Not sure what changed, but all good.

[chriscas]

Hi @gtilles,

As a Canvas admin, I absolutely want the Canvas API to follow the permissions of the user making the API calls.  That's a pretty core part of permissions and security in my opinion.

The scenario you mention here around pronouns and SIS should be doable though.  One option would be to use the SIS Import to set user info (this is probably a common method, but it's more of a "batch" than "live" update scenario.  The other option would be to create an admin account for your SIS and then generate a token from there,  With appropriate admin permissions, the SIS could use that user's Canvas API token to update info for multiple users.

I hope this info helps and perhaps gives a different idea of how to get what you need done that what you may have originally had.

-Chris

[gtilles]

We already run the api calls with the highest authority as you mentioned at the end of your post, the first part of your post doesn’t apply because that isn’t what we are doing or suggesting, SIS imports could be a possibility so I will investigate that a bit more.