Groups and Group Members API give 403 Forbidden, but in web interface members are shown

[rolfis]

Hi, 

I'm currently developing a group app where the logged in user needs to find out who is a member of other groups in the course.

When I use the Groups API /api/v1/groups/:group_id to find information about a particular group the logged in user is not a member of, or Group Users API /api/v1/groups/:group_id/users, I get 403 Forbidden. Accessing the API about groups the logged in user IS a member of works fine.

This seems strange, because when I use the Course Groups API /api/v1/courses/:course_id/groups I get information about groups that fail with 403 in API's above.

And when I use the web interface as the logged in user, I can see the group under "People/Groups" and I can see the members.

Anyone have an explanation?

All the best,
Rolf Johansson

[JamesSekcienski]

@rolfis 

Based on the network traffic, it looks like the data that is shown in Canvas is retrieved using API calls under Group Categories rather than Groups.  Have you tried using API calls from Group Categories?

[rolfis]

Hi,

You are right, some information is shown in the group categories api. However, I was also looking for the primary email address of the users in the group, but it turns out this is managed by a permission that (in our installation) students are not allowed to read (Users - view primary email address).

So long story short, I used the Conversations API instead in my application, to send a message to the whole group. Sometimes you find other ways of doing things than what you planned for from the start. 🙂

Thanks for your input!

All the best,
Rolf Johansson

[JamesSekcienski]

I'm glad to hear you found a workaround.  It is probably for the best that it relies on the Canvas Inbox rather than email address in case someone changes their primary email address to a personal email address that they don't want shared with others.