Canvas API Error [{'message': 'user not authorized to perform that action'}]

[npadgett]

Hello All,

I am experiencing the follow error message when using the canvas rest api {'message': 'user not authorized to perform that action'}. Specifically, the endpoint that returns the error sometimes is GET /api/v1/users/:user_id/courses/:course_id/assignments when retrieving assignments for a student. I have narrowed it down to students that are inactive in the course. I still need to get access to assignments that are graded for this student even if they are inactive. Our access token has full permission to all canvas resources so I am confused why I am getting this not authorized error.

Any insight would be extremely helpful. Thank You!

[James · Accepted solution]

npadgett,

This is consistent with the API documentation for List assignments for user (emphasis mine).

Returns the paginated list of assignments for the specified user if the current user has rights to view.

Since the student is inactive, they don't have rights to view it. You need to make the without pretending to be the student.

I use the Submissions API and the List submissions for multiple assignments endpoint. When you specify a student_ids[], it doesn't matter whether the student is inactive or not.

This call fails for an inactive student:

GET /api/v1/users/3346297/courses/896851/assignments

This call suceeds for the same inactive student:

GET /api/v1/courses/896851/students/submissions?student_ids[]=3346297

The second one also gives you the score for the assignment, but not the assignment information itself. If you need information about the assignment, look at the includes[] section of the documentation. You can include[]=assignment to get that information.

You may be able to use GraphQL to get the information. GraphQL is nice for only getting the information that you need to get without all the extra fluff. For example, if you just needed the score, points possible, and assignment name, you could use this query.

query StudentGrades {
  course(id: "896851") {
    submissionsConnection(studentIds: "3346297") {
      edges {
        node {
          score
          assignment {
            name
            pointsPossible
          }
        }
      }
    }
  }
}‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

That request is likely to return all of the grades at once for the student and do it fairly quickly. With the REST API, you are limited to 100 results at a time for the submissions API.

Here's a comparison for my sandbox course and test student shown above.

• Using the submissions API, the request had an x-request-cost of 0.608 and took about a second to download just the first 100 assignments (yes, my sandbox has more than 100).
• Using GraphQL, the request had an x-request-cost of 0.125 and took 187 ms to download all of the assignments with grades.

The Submissions API returned assignments that were missing but the graphQL approach did not.

I don't do much with GraphQL, but the Submissions API is the one used by the Canvas gradebook, so that's the one I tend to stick with.

[npadgett]

James,

Thank you for the quick response. I was under the impression that the access token did not have rights to view the assignments but it is in fact that the user with the user id sent in the GET request does not have the right permissions. Thank you for clarifying that.

[LinkFuse]

We had the exact same problem and tried your suggestion of calling for course submissions with the student id as a parameter and it still throws the same error.

Could something be wrong with the course?

Thanks!

[James]

@LinkFuse 

It would be strange to have a problem with the course itself. It is more likely a problem with the access token of the person making the call, an ID that you are using not matching something within the context (calling 1234 when it's 1243), or a call that you have to masquerade as another user to get the proper results.

By that last one, there are cases where you may have admin rights, but if you're not assigned something, then it fails to give you results for it unless you masquerade as someone who is assigned that item.

For the first one, you need to make sure that you include the header that has the authorization token in it and that the token has not expired yet.

It's always possible that the GraphQL is malformed, although likely wouldn't generate an unauthorized error. Regardless, I would go to your instance/graphiql and get it working there without out variables before trying to automate it. If it works there, then we know the issue is on the calling side through the API (could be token issues or not forming the request properly).

[LinkFuse]

Hi James,

Thanks for the quick response. We are using the REST Api and are including the access token in the header properly (most other calls work fine); this specific request for assignments by course and user works fine for some students and not others.

What we're failing to understand is this:

"By that last one, there are cases where you may have admin rights, but if you're not assigned something, then it fails to give you results for it unless you masquerade as someone who is assigned that item."

Who do we masquerade as if the student is inactive? Why doesn't admin rights cover all calls? It's confusing and doesn't seem to be addressed in the documentation.

Thanks for any help you can provide! We appreciate it.

[amaan_rana]

Hi LinkFuse, Were you able to work this out? I am facing a similar challenge

[Doug9]

Thanks @James.  I had a similar problem trying to retrieve student assignment grades where the API was returning "user not authorized to perform that action".  Turned out my problem was not permissions but in using my local SIS student IDs in the URL student_id[] parameter instead of the expected student Canvas REST API IDs.

The solution was to add a "sis_user_id:" prefix in URL param.

/api/v1/courses/:course_id/students/submissions?student_ids[]=sis_user_id:<student SIS id>