API Permissions

[gtilles]

What I've noticed is that when certain settings are not allowed such as below, the API cannot do it either, the api should always have higher permission to perform these tasks.

If we want our SIS to be the authority source for pronouns, we should be able to not allow users to do it in Canvas but the api should still be able to set the values, or maybe the api should be able to change the setting, make the change and put it back to the original state.

Again, I believe authorized API calls should have elevated permissions over the user settings.

Users can delete their institution-assigned email address

Allow users to change their pronouns in Canvas

[chriscas]

Hi @gtilles,

As a Canvas admin, I absolutely want the Canvas API to follow the permissions of the user making the API calls.  That's a pretty core part of permissions and security in my opinion.

The scenario you mention here around pronouns and SIS should be doable though.  One option would be to use the SIS Import to set user info (this is probably a common method, but it's more of a "batch" than "live" update scenario.  The other option would be to create an admin account for your SIS and then generate a token from there,  With appropriate admin permissions, the SIS could use that user's Canvas API token to update info for multiple users.

I hope this info helps and perhaps gives a different idea of how to get what you need done that what you may have originally had.

-Chris