# API: a scope with access to /uploads
**URL:** https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895
**Category:** Feature
**Tags:** rest-api
**Created:** [November 11, 2021, 4:34pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895 "2021-11-11T16:34:17Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@RogerBW](https://meta.discourse.org/u/RogerBW)
#### Post date: [November 11, 2021, 4:34pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/1 "2021-11-11T16:34:17Z")
I have a robot which posts to threads. Sometimes it would like to upload an image first, and include it in the post.
As far as I can see there is no API scope which gives access to /uploads so I have to give it access to everything.
Would it be reasonable (a) to define a standard scope to do this, or (b) to allow a custom scope with access to admin-defined endpoints?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 12, 2021, 12:35am UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/2 "2021-11-12T00:35:30Z")
> [@RogerBW](#):
>
> far as I can see there is no API scope which gives access to /uploads so I have to give it access to everything.
Have you tried? I would think that a user that can post can upload.
---
### Author:  [@RogerBW](https://meta.discourse.org/u/RogerBW)
#### Post date: [November 12, 2021, 9:33am UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/3 "2021-11-12T09:33:39Z")
> [@pfaffman](#):
>
> Have you tried?
Er, yes, or I wouldn’t have posted? Specifically this needs the /uploads endpoint rather than /posts, so the response is 403.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [November 12, 2021, 10:18am UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/4 "2021-11-12T10:18:36Z")
Is this any use?
> [@Reverse engineer the Discourse API](https://meta.discourse.org/t/how-to-reverse-engineer-the-discourse-api/20576):
>
> Discourse is backed by a complete JSON api. Anything you can do on the site you can also do using the JSON api. The API is documented at [docs.discourse.org](https://docs.discourse.org). You can also use the [discourse\_api](https://github.com/discourse/discourse_api) Ruby gem as a client library. However, not every endpoint is documented. To determine how to do something with the JSON API here are some steps you can follow. Example: recategorize a topic. Go to a topic and start editing a category: Open Chrome dev tools, switch to the Network tab, select …
---
### Author:  [@RogerBW](https://meta.discourse.org/u/RogerBW)
#### Post date: [November 12, 2021, 10:57am UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/5 "2021-11-12T10:57:10Z")
Thanks, but not really.
I have uploads working (using the /uploads endpoint). But the only way I can grant API-key permissions for this to work is to grant _all_ permissions, which is an obvious security risk.
What I am asking for is an API permissions scope that includes /uploads - if it formed part of “write posts” that would be fine with me, but there might be reasons for making it a separate thing. Failing that (and probably a good idea in general), I’d like to be able to define a custom scope that includes the specific things I wish to allow.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [November 12, 2021, 11:08am UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/6 "2021-11-12T11:08:20Z")
Having a scope for creating uploads sounds like a good idea to me, certainly #pr-welcome. The relevant change would be around here:
>
Plus a new translation string [here](https://github.com/discourse/discourse/blob/main/config/locales/client.en.yml#L4173).
I think this would make most sense as `"uploads": "create"`
@RogerBW are you willing/able to make a PR here? If so, please do go ahead, and then post the link in this topic.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 12, 2021, 4:51pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/7 "2021-11-12T16:51:16Z")
> [@RogerBW](#):
>
> Er, yes, or I wouldn’t have posted?
Well, not everyone does such obvious things before posting. Sorry about that! It appears that at least one other person (who I would think knows more than I on this particular issue) expected that a scope that could create a post could also create the uploads to go with it.
> [@david](#):
>
> Having a scope for creating uploads sounds like a good idea to me, certainly #pr-welcome. T
Doesn’t it make sense that if a api key can create a post they could also create an upload, just like a user who can create a post can also create an upload?
---
### Author:  [@Simon\_Manning](https://meta.discourse.org/u/Simon_Manning)
#### Post date: [November 12, 2021, 5:21pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/8 "2021-11-12T17:21:01Z")
Are there any situations where uploads are useful outside of a post context? As I understand it, uploads are automatically removed periodically if they are not associated with posts so making it possible to scope an API key for uploading and not creating/modifying posts doesn’t obviously seem useful.
As @pfaffman mentioned, it would seem to make more sense if the topics:write and posts:edit scopes grant access to upload if the associated user has permission to upload.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [November 12, 2021, 7:16pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/9 "2021-11-12T19:16:03Z")
> [@Simon\_Manning](#):
>
> Are there any situations where uploads are useful outside of a post context?
Ya, I’m pretty sure avatars use the same uploads route, but aren’t attached to posts.
---
### Author:  [@Simon\_Manning](https://meta.discourse.org/u/Simon_Manning)
#### Post date: [November 12, 2021, 8:19pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/10 "2021-11-12T20:19:49Z")
Presumably uploading a new avatar is something one might make use of with the users:update API scope. (Which isn’t currently possible?)
With more varied and potential future avenues where uploads might be used, it probably does make sense to create a separate scope and put the onus on the user to choose the appropriate scoping. It’s clear for users when an API key will/won’t be able to upload and avoids potentially missing situations where uploads could be used if/when extending the APIs.
---
### Author:  [@RogerBW](https://meta.discourse.org/u/RogerBW)
#### Post date: [November 15, 2021, 12:22pm UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/11 "2021-11-15T12:22:56Z")
> [@david](#):
>
> @RogerBW are you willing/able to make a PR here? If so, please do go ahead, and then post the link in this topic.
Done. It will need testing and such but here at least is a baseline.
[https://github.com/discourse/discourse/pull/14941](https://github.com/discourse/discourse/pull/14941)
I used a separate scope, for the reasons described - I can certainly see that I might want to allow posts but not uploads.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [November 16, 2021, 12:10am UTC](https://meta.discourse.org/t/api-a-scope-with-access-to-uploads/208895/12 "2021-11-16T00:10:44Z")
Thanks! I added a review in GitHub.