Account Role Permissions

[test]

I'm trying to fetch data from Canvas into my application by establishing the connection using the developer API key. I have enabled the scope and selected the following endpoints: 

Accounts url:GET|/api/v1/accounts

Terms url:GET|/api/v1/accounts/:account_id/terms

Courses url:GET|/api/v1/accounts/:account_id/courses

Course Sections url:GET|/api/v1/courses/:course_id/sections

Users url:GET|/api/v1/accounts/:account_id/users

Rubrics url:GET|/api/v1/courses/:course_id/rubrics

Rubric url:GET|/api/v1/courses/:course_id/rubrics/:id

Assignments url:GET|/api/v1/courses/:course_id/assignments

submissions url:GET|/api/v1/courses/:course_id/students/submissions

I need to authorize the integration with a canvas user (of account role) in my application to complete the setup and fetch the canvas data. Now, this canvas user's account role must have certain permissions to fetch the data. Can someone please help me identify what permissions I should provide to this user's account role in Canvas?

Thank you!

[chriscas · Accepted solution]

Hi @test,

I'd recommend reviewing the  Canvas Account Role Permissions - Instructure Community - 387078  page for some basic info about the account role permissions.  You could start the role with a limited number of permissions and verify whether your API calls all work correctly or not.  For calls that return unauthorized-type errors, you could then dig into the permissions a bit more.

I hope this info helps a bit, even though it's not an exact list as you hoped to get.

-Chris

[KarlSteinbreche]

I run into this type of problem as well.

Abstractly, I want to allow someone to do something specific when they don't have permission to do the general thing. e.g. this teacher can look at their students, but not at other students. 

One idea is that your app handles authentication and permission, i.e., once you've determined the teacher, you allow a call to ../get-my-students, and then your (backend) does the actual query using your credentials and returns the result to the teacher.

Big picture, to give a user access to a nice view of data they should be able to access, you may need to authenticate the user and then do the queries with your permissions, and then deliver their results, to their front end.