Hello!
I’m trying to trigger a “close topic x days after last reply”, but I can’t seem to work out what permission is needed. I don’t really want to grant a full write permission.
Specific endpoint:
POST /t/{ID}/timer
Example payload:
status_type=close&based_on_last_post=true&duration_minutes=20160
Can anyone point me in the right direction, please?
Many thanks in advance!
Hey Mathew,
Could you share the error that is being triggered for review?
Hey @pedro
I always had a 403 back unless I gave full write access.
From the hints in the API view of the different URLs supported, none seem to match the format of the timer one (/t/{ID}/timer). But I could just be missing something 
I’d prefer not to give full write access so just trying to identify which permission is needed for this in particular.
Thanks!
The 403 is likely related to the permission required by the topic timer endpoint rather than the duration_minutes or based_on_last_post parameters.
I’d check the endpoint’s authorization requirements in the current Discourse source for POST /t/{id}/timer, rather than relying only on the permissions shown in the API documentation. The timer action may require the same topic-level write/moderation capability used by the UI, which would explain why full write access currently works.
If there is a more granular permission available for topic timers, it should be possible to identify it from the endpoint’s authorization check and the corresponding policy/guardian method. Otherwise, restricting the API key to only the required topic scope would be preferable to granting broader write access.