What permission is needed for the "GET /api/v1/users/:user_id/courses" REST API?

Question

We have created a Role with these permissions in Canvas:

* Announcements - view
* Conversations - send messages to individual course members
* Course Content - view
* Discussions - create
* Discussions - post
* Discussions - view
* Grades - view all grades
* Item Banks - manage account
* SIS Data - read
* Student Collaborations - create
* Users - act as
* Users - view list

Then we generated an "access token" for a user under that Role, and tried accessing the "/api/v1/users/:user_id/courses" API in this way: https://oohlala.instructure.com/api/v1/users/sis_login_id:abc@test.com/courses?access_token=****

The response is:  { "status": "unauthorized", "errors": [ { "message": "user not authorized to perform that action" } ] }

In this document: https://canvas.instructure.com/doc/api/courses.html, we found this description

List courses for a user
GET /api/v1/users/:user_id/courses
Scope: url:GET|/api/v1/users/:user_id/courses
Returns a paginated list of active courses for this user. To view the course list for a user other than yourself, you must be either an observer of that user or an administrator.

We cannot find the permissions needed for the "administrator". Does anyone know what permissions we should add to our Role in order to access that API?

YunyiZhang · Answer

@CanvasNeil @chriscas

We tried adding the permissions you suggested:

* Course Content - add / edit / delete
* Courses - view list

It still doesn't work -- we got the same response: { "status": "unauthorized", "errors": [ { "message": "user not authorized to perform that action" } ] }

We also tried adding another permission:

* Users - allow administrative actions in courses

And it still didn't work...

We noticed that if we add Role "Account Admin" which has all permissions to our user, we can indeed get a good response from the "/api/v1/users/:user_id/courses" API. But our customer doesn't want to grant us all the permissions, so we still need to figure out which permission is specifically needed for that API.

Is there any other permissions we should give it a try?

Chris · Answer

I'm guessing "Courses - view list" is probably needed, although it appears to be geared more towards course lists for an account than a user.  I'd suggest trying it out.

-Chris

CanvasNeil · Answer

Try adding the "Courses - add / edit / delete" permission to your role.