Read-only data access tokens?

Jump to solution
John_Lowe
Community Champion

Is there such a thing as a read-only Data Access Token?  For instance, can a token be generated that allows any GET requests but denies any POST requests?

Labels (1)
1 Solution
karl
Instructure Alumni
Instructure Alumni

John, technically no, but API tokens are scoped to have the same permissions as the user does in Canvas. It is possible to restrict access by creating a custom role with specific permissions then attaching a user to the role and issuing the API token for that user. It's not ideal and token scoping is something we have discussed and plan to develop more around in the future.

View solution in original post