# API scope problem for "group members" call

**URL:** https://meta.discourse.org/t/api-scope-problem-for-group-members-call/368109
**Category:** Bug
**Tags:** pr-welcome
**Created:** [May 29, 2025, 3:40pm UTC](https://meta.discourse.org/t/api-scope-problem-for-group-members-call/368109 "2025-05-29T15:40:51Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [May 29, 2025, 3:40pm UTC](https://meta.discourse.org/t/api-scope-problem-for-group-members-call/368109/1 "2025-05-29T15:40:51Z")

</div>

- create an API key

- set the scope to manage groups and enter the ID of the group (e.g. 10 for trust\_level\_0)

- Try to call the API

`curl -H "Api-Key: ***" https://test.example.com/groups/trust_level_0/members.json`

→ 403 `{"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"}`

Try the ID  
`curl -H "Api-Key: ***" https://test.example.com/groups/10/members.json`

→ 403 `{"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"}`

The reason is that the scope restricts the call to a parameter `id`  
But for this specific call the parameter is called `name`. So it will never work.

 ![image](https://global.discourse-cdn.com/meta/original/4X/0/7/9/0793ba3037f787517fcaf128aa1d5a752f4cc62f.png)

Hacking the database and changing the scope to `{"name": ["trust_level_0"]}` makes this call work (it will break all the others though).

---

_[View the full topic](https://meta.discourse.org/t/api-scope-problem-for-group-members-call/368109)._