Added by Duy Lê Quang 2 days ago
In the document for Users API: https://www.openproject.org/docs/api/endpoints/users/, it said that user with manage_members or share_work_package permission can access the endpoint when it is not the case.
The user with manage_members or share_work_package can access /api/v3/principals, but getting /api/v3/users will face 403
Replies (3)
Hello Duy,
the /users endpoint docu mentions the general Administrator or the global permission to manage users (create users, edit users). Could you point me to the part where the share_work_package permissions is mentioned? I would like to investigate this further and eventually adjust the documentation.
Best
Alexander
This is the part where it said that normal users who are not admin can call list users with manager user and share work packages permission.
Hello Duy,
thank you for pointing this out! Indeed, a user with solely manage_members and/or share_work_package permission will receive an error 403.
Accessing such user data is an admin level topic as described in this endpoints description above. That is why it only works with admin permissions or global admin-like permissions. I reckon this example description needs to be updated and will connect with the team regarding this.
Best
Alexander