# Confirming API Access to Authoring Limit Site Settings

**URL:** <https://meta.discourse.org/t/confirming-api-access-to-authoring-limit-site-settings/407937>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [July 18, 2026, 8:21am UTC](https://meta.discourse.org/t/confirming-api-access-to-authoring-limit-site-settings/407937 "2026-07-18T08:21:13Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![philh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/philh/32/532740_2.png) [@philh](https://meta.discourse.org/u/philh)\
**Post date:** [July 18, 2026, 8:21am UTC](https://meta.discourse.org/t/confirming-api-access-to-authoring-limit-site-settings/407937/1 "2026-07-18T08:21:13Z")

</div>

I’m working on an integration that publishes and syncs companion topics into Discourse via the API. For setup diagnostics, I’d like to read the forum’s current authoring limits so the integration can preflight content before attempting to create or update topics.

The settings I’m trying to confirm access for include:

```plaintext
min_topic_title_length
max_topic_title_length
min_first_post_length
min_post_length
max_post_length
max_tags_per_topic
max_tag_length
tagging_enabled
create_tag_allowed_groups
tag_topic_allowed_groups

```

I first checked `/site.json`, which is accessible and useful for public capability hints, but it does not appear to expose these concrete authoring-limit settings.

With an API key for a non-admin bot user, these returned `404`:

```plaintext
/site_settings.json
/admin/site_settings.json
/admin/site_settings

```

After making the bot user an admin, these worked:

```plaintext
/admin/site_settings.json
/admin/site_settings

```

Using headers:

```plaintext
Accept: application/json
Api-Key: ...
Api-Username: discussbridge-bot
X-Requested-With: XMLHttpRequest

```

`/site_settings.json` still returned `404`.

My questions:

1. Is `/admin/site_settings.json` the expected API path for reading current site settings?
2. Is admin user permission required, or is there a supported read-only/granular API scope for this?
3. Is `/site_settings.json` deprecated, plugin-dependent, or not expected to exist?
4. For integrations, is the recommended pattern to use an admin-capable diagnostics/setup key for reading settings, while using a less-privileged publishing key for normal topic/post sync work?

The goal is not to change settings via API, only to read them during setup diagnostics so the integration

---

_[View the full topic](https://meta.discourse.org/t/confirming-api-access-to-authoring-limit-site-settings/407937)._