Scope "users:show" does not include admin routes

Contribute Bug

AI-generated summary

johann150 reports a bug where the users:show scope for REST API tokens does not include the /admin/users/:id.json route, despite it being the only available endpoint to access a user by their unique ID. The user notes that this URL is missing from the help popup’s permitted URLs and cannot be found under any other permission. This behavior contrasts with other scopes, such as badges:list or groups:manage_groups, which generally include relevant admin routes in their permitted URLs.

1

When creating a scoped token for the REST API, I want to be able to access a user by their unique ID, for which the API currently only provides /admin/users/:id.json. So I want to permit this route on a granular API token.

However, this URL is not included in the permitted URLs when I check the help popup for the users:show permission. I could also not find any other permission which would permit this URL. It seems that generally admin routes are included for other scopes, e.g. badges:list or groups:manage_groups.