Im a student and I generated an access token, Im having issues making requests to certain endpoints, I'm wondering how I can check what permissions I

[FlavioHerrera]

Im building an application that is making use of the canvas rest api tool with an access token I generated. Im able to get information like course assignments, quizzes, user information but Im not able to update it. Im wondering if there is a way to elevate my permissions.

[mzimmerman]

Hi @FlavioHerrera 

Any access token you create is tied to your account allows the script to run with the same permissions as your user account has. 

[chriscas · Accepted solution]

Hi @FlavioHerrera,

API Access Tokens are tied to whatever permissions your user role has in Canvas.  The only things you'll be able to do with the API (in general) are things you could also do in the Canvas web UI.  You could ask your school/institution Canvas team if they'd be willing to set up a sandbox course and put you in as a teacher if you have a legitimate use case, but do not be surprised if they say no, due to all of the sensitive data that Canvas has.  Even granting teacher permissions in a sandbox course could have affects on how third-party integrated tools work in real courses, so many schools will be hesitant to give out that access.

Hope this helps a bit.

-Chris

[jlee16]

Hi, @chriscas - can you tell me more about how teacher permissions in a sandbox course can affect third-party tools in real Canvas courses?  I'm working on our personal access token policy but am not an API pro, so am trying to understand where we need to be cautious.  We give our TAs almost identical permissions to our instructors and trust that they'll make good decisions in the UI, but do we have reason for concern about that level of course access via the API?

Thank you in advance for your expertise!

[chriscas]

Hi @jlee16,

I'll try to give the best answer I can without going super far in the weeds in this...

Essentially, when a 3rd party tool is launched from Canvas via the LTI standard, some information about the user, course, etc is sent to that 3rd party tool so it can determine how to function for the user.  One of the core elements involved is the user's roles.  This sounds pretty simple, but the devil is in the details...

As you know, a user can have different roles in different courses (a student in one course, a TA in another, a teacher in a third, etc).  This is very handy as it matches many realities in the real world where people can have multiple roles, but it can also lead to confusion for 3rd party tools.  There are three different categories of role info that are required by the LTI standard. ..

The first is the "system" role, which in almost every case I know for a logged in user with Canvas will have a value of "person#user".  The second is the "membership" role (only used when launching from within a course), which would be a user's course level base role,  such as membership#Instructor".  The third one, which tends to be where issues come is, is the "institution" role...  The institution role will be any role the user has in any Canvas course they belong to, and will also indicate if they are an admin.  To illustrate a real-world example, I'm pasting a screenshot of what is sent to 3rd party tools for me (I'm a root Canvas admin, and have also added myself as a teacher and a student in various courses)

So as you can see, the tool sees that I have 3 institution roles (Administrator, Instructor, and Student), along with my system role of User and my membership of Instructor (this launch info is from a course where I'm a teacher).

So tools developers get all of this info and have to decide which role to look at to figure out what sort of access to give that user in their tool.  A lot of admins heavily suggest that developers use the membership role, as it is the most specific info about the user from where they launched the tool.  If the tool only works in the course, that's a viable option.  However, tools which are placed in areas outside of a course (like global navigation or user navigation) won't have that membership value to look at.  This is where the issue can creep in...  If a user is only a student everywhere, there will only be a student role sent, and the tool can easily know to give them whatever a student should see.  If the user is a student in one course and a teacher in another, the tool has to decide which of those to use (and usually pics the role with the greater access).  So there are times where a student who's added as a TA or Teacher to provide assistance or work on a project will get more access to third party tools, even within courses (because the tools don't all use the membership role, even if it's available), than they really should.

So in closing, this isn't really an API issue at all, but I only mentioned it around the API request because the original poster had asked about getting elevated permissions to use more of the API than their normal role would allow.

I hope this makes sense and helps you out a bit.  Feel free to reply if you have any questions or need additional detail on any of this!

-Chris

[jlee16]

Hi, @chriscas - I'm sorting through my ridiculous number of open browser tabs and realized I never thanked you for this tremendously helpful and detailed explanation!  I think we've got both our API tokens and system roles (via SSO) sorted out now, and I've bookmarked this page for future reference if needed.  Thank you for the help!

~jodie