Student access token privileges

[giddyg]

Is there a difference between manually generated user access token vs token generated using developer’s key and oAuth protocol? Difference as in terms of privileges granted by the token? It seems logical that no matter the way generated - the token will have privileges as the user themselves, but I’m not sure.

Also, Is there a way for a student user to look at their own page views using API? I’ve generated token as a student, and tried fetching my page views but I get the error that I’m not authorized to see it (and neither am I as a teacher). As a student I also can’t see reports on my quizzes, statistics, quiz questions, quiz submission questions, and quiz submission events. Many of those seems logical for a student to be able to view, since they are the ones generating data. What privileges does a student’s access token have in terms of fetching data and metadata generated by the student? It’s more that discouraging to see that student is not authorized to see submission events, quiz submissions and results, and page views.

Here are some of the API endpoints that student is not authorized to access:

https://canvas.instructure.com/doc/api/quiz_submission_events.html#method.quizzes/quiz_submission_ev...
https://canvas.instructure.com/doc/api/quiz_questions.html#method.quizzes/quiz_questions.show
https://canvas.instructure.com/doc/api/quiz_submission_questions.html#method.quizzes/quiz_submission...
https://canvas.instructure.com/doc/api/quiz_reports.html#method.quizzes/quiz_reports.index
https://canvas.instructure.com/doc/api/quiz_statistics.html#method.quizzes/quiz_statistics.index

[pklove · Accepted solution]

There shouldn't be any difference between the privileges the two tokens have. 

Also, the privileges should be the same as the logged in user, so you can easily check which API GETs are allowed by just putting the URL into your browser.

I guess some of the endpoints you want to call just aren't granular enough to be able to be used by a student and others just haven't had the permissions applied.   If you have specific use cases you could add the API requirements to Ideas.

[giddyg]

Thanks! I find it very odd that student can't access the pages views and events they themselves made. It's not so much about my use case, I'd rather want more open data (via API) so I could more easily do some analytics in my app.

Is there a way I could review privileges for student, in terms of what API endpoints they are authorized to use? Manually poking all the endpoints is really slow process (although I've been doing that already ).

[pklove]

I don't think what you want is documented, perhaps you could post the results of your endpoint poking when you are finisied

[giddyg]

pklove‌ it seems that in the meantime new API endpoint sneaked in:

Scopes - Canvas LMS REST API Documentation 

I haven't yet tested it, because I do not have the latest version of the Canvas, but it seems that it lists all the token privileges. But it also requires one to know the Account ID, which would either mean that the devoleper is high level Canvas admin, or that Canvas admin should supply developer with the proper ID. There is a way to list accounts and to get their IDs, but again the user that calls the API has to have higher privileges than a student, and probably even than a teacher:

Accounts - Canvas LMS REST API Documentation