Discourse Events exposes a number of REST endpoints under /discourse-post-event/..., but when creating an admin API key with Granular scope there does not appear to be an Events-specific scope.
There is already a discourse-calendar:events_calendar user API key scope for calendar subscription feeds such as the ICS endpoint, so this request is specifically about granular admin/server-to-server REST API keys, rather than calendar subscription keys.
Use case
An external integration may only need to query Discourse Events - for example, to check whether an event exists or retrieve event information.
At present, there doesn’t appear to be a way to issue an admin API key restricted specifically to the Discourse Events REST endpoints. That means an integration may need to be given access to a broader API scope than it actually requires.
It would be useful for discourse-events to register granular API key scopes for its REST routes so integrations can follow the principle of least privilege.
Ideally these could distinguish between operations, for example:
- read/query events
- manage events
- manage event invitees
Even an initial read-only Events scope would be useful.
A recent related report also noted that, when trying the Granular API key scope, there was no apparent restriction available for the Events endpoints.
The existing Events routes retain the /discourse-post-event/... URL namespace for compatibility, despite the plugin itself now being named discourse-events, so I don’t think the scope necessarily needs to use the old plugin name.
I don’t currently have enough time to put together a PR for this, but I wanted to raise it as a feature request in case it would also be useful to other integrations or be suitable as a pr-welcome change.