User Profile REST API response missing "sis_user_id" for non-Admin roles?

[akshya]

Hi There

I develop an LTI application for Canvas that tracks Attendance for classrooms. We use Canvas' REST APIs to retrieve data such as Course Data, Course Enrollment Data, User Data, etc. One of the important things for our application is to be able to retrieve user data such as SIS ID, Integration ID or Login ID which is then used by other parts of the application. In order to retrieve this data, I've been using the "GET /api/v1/users/:user_id/profile" API. 

Recently however, I've started noticing that this API has stopped returning an SIS ID (or sis_user_id as it's labeled in the REST response). I'd actually come across this issue in the past but it had been resolved, so I am not sure what has caused it to crop up again. 

As an example, we have a sample user "Selina Kyle" in our sandbox environment who has user_id "19" and has been assigned the SIS ID "875663". When our Attendance tool is opened in a course where Selina is enrolled, the tool would make a REST request on behalf of the logged in user to get Selina's profile (https://<our environment>/api/v1/users/19/profile ). It is at this spot that I am seeing the difference in the responses.

When the logged in user is an Instructor in the course, the response we are getting is :

{"id":19,"name":"Selina Kyle","short_name":"Selina Kyle","sortable_name":"Kyle, Selina","title":null,"bio":null,"login_id":"skyle@goqwickly.com","integration_id":null,"time_zone":"America/New_York","locale":null}

However, when the logged in user is a System Administrator in the environment, the response we are getting is :

{"id":19,"name":"Selina Kyle","short_name":"Selina Kyle","sortable_name":"Kyle, Selina","sis_user_id":"875663","integration_id":null,"title":null,"bio":null,"primary_email":"skyle@goqwickly.com","login_id":"skyle@goqwickly.com","time_zone":"America/New_York","locale":null}

As you can see, the "sis_user_id" seems to be blocked when the profile is being retrieved by a non-system administrator. I tried updating our developer key to use specific scopes rather than all scopes, but no change in the responses was observed. I am looking for a way to have this sis_user_id be returned for all roles who would be using our tool. Any information or help on this issue is highly appreciated!

[jsavage2]

Hi Akshya,

Yes, this is correct. The user the script is running as must have an account role that has the “SIS Data – read” permission. And any permissions it relies on.

The simplest solution is probably to create a special “Attendance Script” user that has just the limited permissions needed to retrieve the data, and use that to make the API calls.

[akshya]

Thank you for the feedback, Jay!

I don't know if creating a new user with the limited permissions would necessarily solve the issue in our case. Our LTI Tool is used for Attendance taking, so we need to allow all kinds of user roles access to our tools capabilities.

One more thing that I'm noticing now, in my environment the "teacher" role does seem to have the "SIS Data - read" permission enabled (I've attached a screenshot).

This is the enrollment response I get for my teacher account in the course, just to confirm that the account I seeing this bug with is a Teacher role that should be allowed to view SIS IDs -

{"id":395,"user_id":9,"course_id":9,"type":"TeacherEnrollment","created_at":"2019-05-22T15:16:31Z","updated_at":"2019-05-22T15:16:49Z","associated_user_id":null,"start_at":null,"end_at":null,"course_section_id":8,"root_account_id":1,"limit_privileges_to_course_section":false,"enrollment_state":"active","role":"TeacherEnrollment","role_id":4,"last_activity_at":"2019-06-21T19:06:47Z","last_attended_at":null,"total_activity_time":7393,"sis_account_id":null,"sis_course_id":null,"course_integration_id":null,"sis_section_id":null,"section_integration_id":null,"sis_user_id":"00007","html_url":"https://qwickly.instructure.com/courses/9/users/9","user":{"id":9,"name":"Akshya Pandey","created_at":"2018-03-28T09:41:26-06:00","sortable_name":"Pandey, Akshya","short_name":"Akshya Pandey","sis_user_id":"00007","integration_id":"cgfhncgfhmcm","login_id":"akshya@goqwickly.com"}}

As far as I know, I should be getting the SIS IDs!