rich.steenwyk (Community Member) asked a question.

December 11, 2020 at 6:56 PM
Identity API 'teams' endpoint only returns teams that caller is a member of ... ?

Using the example form the documentation: https://help.veracode.com/r/c_identity_list_teams

The results always only contain the teams that the API caller is a member of and not the full list of teams for the organization which is what's suggested should happen.

 

I see this same behavior with a human account (with Administrator permissions) and an API account (with Admin API permissions)

 

Are there additional parameters to the query or something that I'm missing?

  • 6 answers
  • 400 views
VCode likes this.

    • rich.steenwyk (Community Member)

      Thank you for the reply and the link to the additional information. When applied to the query at the 'teams' endpoint, it works as expected, returning all teams.

       

      I will, however, add that the way it is documented is about as confusing as it could be.

      1) The information is not listed in the previous section titled "Listing Teams with the Identity API" (which is where one would expect to find information about viewing multiple teams)

      2) The information is shown in a section about getting details for a single-team and easy to pass over, not to mention being mentioned after a discussion about the required a Team GUID query parameter.

      3) The information is 'hidden' in a "JSON code sample" that is not shown in the command line example as an input file.

      4) The JSON document is actually a configuration specification for additional query parameters and is not a body document as the wording "The API passes the JSON file that you populate with the necessary values..." suggests.

      5) The information is not present in either the [JSON](https://help.veracode.com/viewer/document/pVeWZ12K6mnj64gVuhLNew) or [Swagger](https://app.swaggerhub.com/apis/Veracode/veracode-identity_api/1.0) documents

      Expand Post

      • Jason M., Veracode Support (Veracode)

        Hello @rich.steenwyk (Community Member)​ ,

         

        Glad to hear that the parameter worked. The team that updates the documents for our Help Articles has been made aware of these issues and an internal ticket has been opened to update the Help Articles that relate to this. Hopefully this will help avoid any further confusion and make the parameter easier to find.

         

        Jason

        Community Support Engineer

        Expand Post

    • rich.steenwyk (Community Member)

      Alas, the story does not end there. It seems that the "all_for_org" parameter is insufficient when used with a API account. In that case, I get a 403 Forbidden response, whereas it worked fine when using credentials associated with a human user..

       

      I also tried adding an explict "org_id" parameter that is also mentioned in the referenced documentation, but this did not change the results.

       

      Is a human-user required to access this endpoint in this way?

      Expand Post

      • rich.steenwyk (Community Member)

        A workaround for this limitation, if true, is to make the API account a member of all teams and not use the "all_for_org" parameter. However, this increases costs in maintaining the team membership for that API account.

      • Jason M., Veracode Support (Veracode)

        @rich.steenwyk (Community Member)​ ,

         

        When a user doesn't have access to request all teams for their organization, then a 403 is expected (for an API Service Account the user will get a 403 if they are team restricted).

         

        Jason

        Community Support Engineer

        Expand Post

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.