# API permission required for triggering topic timer

**URL:** https://meta.discourse.org/t/api-permission-required-for-triggering-topic-timer/412695
**Category:** Support
**Tags:** rest-api
**Created:** [September 17, 2026, 7:58pm UTC](https://meta.discourse.org/t/api-permission-required-for-triggering-topic-timer/412695 "2026-09-17T19:58:01Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Parker1090](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/parker1090/32/119862_2.png) [@Parker1090](https://meta.discourse.org/u/Parker1090)
#### Post date: [September 17, 2026, 7:58pm UTC](https://meta.discourse.org/t/api-permission-required-for-triggering-topic-timer/412695/1 "2026-09-17T19:58:01Z")

</div>

Hello!

I’m trying to trigger a “close topic _x_ days after last reply”, but I can’t seem to work out what permission is needed. I don’t really want to grant a full write permission.

Specific endpoint:  
`POST /t/{ID}/timer`

Example payload:

```plaintext
status_type=close&based_on_last_post=true&duration_minutes=20160

```

Can anyone point me in the right direction, please?

Many thanks in advance!

---

<div class="post-metadata">

### Author: ![pedro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pedro/32/365099_2.png) [@pedro](https://meta.discourse.org/u/pedro)
#### Post date: [September 18, 2026, 10:03pm UTC](https://meta.discourse.org/t/api-permission-required-for-triggering-topic-timer/412695/2 "2026-09-18T22:03:52Z")

</div>

Hey Mathew,

Could you share the error that is being triggered for review?

---

<div class="post-metadata">

### Author: ![Parker1090](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/parker1090/32/119862_2.png) [@Parker1090](https://meta.discourse.org/u/Parker1090)
#### Post date: [September 24, 2026, 9:46am UTC](https://meta.discourse.org/t/api-permission-required-for-triggering-topic-timer/412695/3 "2026-09-24T09:46:36Z")

</div>

Hey @pedro

I always had a 403 back unless I gave full write access.

From the hints in the API view of the different URLs supported, none seem to match the format of the timer one (`/t/{ID}/timer`). But I could just be missing something 🙂

I’d prefer not to give full write access so just trying to identify which permission is needed for this in particular.

Thanks!

---

<div class="post-metadata">

### Author: ![Kamal\_S](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kamal_s/32/578813_2.png) [@Kamal\_S](https://meta.discourse.org/u/Kamal_S)
#### Post date: [September 24, 2026, 11:25am UTC](https://meta.discourse.org/t/api-permission-required-for-triggering-topic-timer/412695/4 "2026-09-24T11:25:11Z")

</div>

> [@Parker1090](#):
>
> I always had a 403 back unless I gave full write access.
> 
> From the hints in the API view of the different URLs supported, none seem to match the format of the timer one (`/t/{ID}/timer`). But I could just be missing something 🙂
> 
> I’d prefer not to give full write access so just trying to identify which permission is needed for this in particular.

The 403 is likely related to the permission required by the topic timer endpoint rather than the `duration_minutes` or `based_on_last_post` parameters.

I’d check the endpoint’s authorization requirements in the current Discourse source for `POST /t/{id}/timer`, rather than relying only on the permissions shown in the API documentation. The timer action may require the same topic-level write/moderation capability used by the UI, which would explain why full write access currently works.

If there is a more granular permission available for topic timers, it should be possible to identify it from the endpoint’s authorization check and the corresponding policy/guardian method. Otherwise, restricting the API key to only the required topic scope would be preferable to granting broader write access.