[oshchyhol]

Motivation

A reset gives back a new secret with every permission of the old token. So the API now refuses to reset a different token unless the calling token has Admin access to everything that token can access. Before, Admin access to the token's sub account was enough, even when the token also reached the organization or other sub accounts. A token can still reset itself.

The 403 was already listed for this operation; the description didn't say when it happens.

Merge once the API change is live.

Changes

• say in the "Reset API token" description when a reset of another token gets a 403

How to test

• the "Reset API token" page description says that resetting a different token needs Admin access to everything that token can access, and that otherwise the request gets a 403
• the page still lists the 403 response

Images and GIFs

N/A

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn