Accessing Create/Update Framework APIs

[kameshbhr]

I am trying to understand the access privileges to call the Write APIs related to the Frameworks - such as Create/Update Frameworks, Create/Update Categories of a framework. I went through the API documentation here: https://documenter.getpostman.com/view/25463377/2s8ZDa32ay#43c4fb52-a4d6-486c-beec-6c262571bf4a

I have few queries:

1. Create and Update Framework APIs require "X-Channel-Id". It says - "It is the Unique Id to identify the root organisation to which the user belongs". Is it unique id of root organization or user token of a logged in user?
2. Create Framework API also takes a Channel id in its request body. Is it related to the root org of the user calling the API? Is there any validation of X-Channel-Id against the Channel id passed in the request body?
3. Create/Update Category APIs do not take any X-Channel-Id. Does it mean any user will be able to create/update categories?

[kameshbhr]

@vinukumar-vs @pallakartheekreddy @maheshkumargangula Can you please respond on these queries?

[maheshkumargangula]

Create and Update Framework APIs require "X-Channel-Id". It says - "It is the Unique Id to identify the root organisation to which the user belongs". Is it unique id of root organization or user token of a logged in user?

It is the unique ID (channel ID) of the root organization.

Create Framework API also takes a Channel id in its request body. Is it related to the root org of the user calling the API? Is there any validation of X-Channel-Id against the Channel id passed in the request body?

Yes. It is the root organization channel ID from Knowlg. The create API checks only whether the channel exists or not.

Create/Update Category APIs do not take any X-Channel-Id. Does it mean any user will be able to create/update categories?

The Knowlg APIs don't have the understanding of user token. These APIs onboarded to API gateway for only the users with specific roles (like tenant admin etc,.) can access these create/update APIs. @gandham-santhosh please share the API access control details for the framework, category create/update APIs.

Cc: @pallakartheekreddy

[kameshbhr]

Thanks @maheshkumargangula

Yes. It is the root organization channel ID from Knowlg. The create API checks only whether the channel exists or not.

Then what is the use of passing X-Channel-Id of the user's root org?

These APIs onboarded to API gateway for only the users with specific roles (like tenant admin etc,.) can access these create/update APIs.

So what I understand is that the Knowlg APIs don't have any access restrictions within them. Can we restrict a user with admin role in tenant A not create/update frameworks in another tenant B using API gateway? I would like to understand how this can be done.

[maheshkumargangula]

So what I understand is that the Knowlg APIs don't have any access restrictions within them. Can we restrict a user with admin role in tenant A not create/update frameworks in another tenant B using API gateway? I would like to understand how this can be done.

@kameshbhr – We don't have this restriction now. Not possible with API gateway. Using Kubernetes OPA we should be able to define these rules and handle this.

[pallakartheekreddy]

@kameshbhr As we haven't received a response from you, we will proceed to close this thread. If you have any further questions or require assistance in the future, please don't hesitate to start a new thread. Thank you.