I flag certain posts using the API and Python. This has worked for several years, until a recent upgrade to 3.2.0.beta4-dev. Now I get DiscourseClientError: You are not permitted to view the requested resource. My API key is still valid and is not revoked. Reverse-engineering by flagging a post manually shows the payload for flagging has not changed (except maybe the value of flag_topic, but that doesn’t seem to matter). Any ideas?
self._post(
"/post_actions",
id=post_id,
post_action_type_id=7, # flag it
message=msg,
flag_topic=True
)
One recent change to flagging was a move to a group-enabled setting versus a trust level one (flag post allowed groups), if that could be connected in some way?
So maybe All Users no longer have permission to flag, and I need a new API key for a Single User who does have permission (myself, for instance)? It’s not clear to me what “All Users” means. TL0?
Theoretically, as the default of TL1 has stayed the same during the setting swop over, I would have thought the same permissions for the API key would still work, though as it’s now based on group rather than trust level there may be something else having an effect. There was a report of the group’s visibility being a factor in another quirk that cropped up for one of the other settings that’s been moved to the group-allowed format. By any chance, have you changed the visibility of your TL1 group at any point?
I’ve also tried with a new API key, this time for a Single User “discobot”, (my webhook runs as user discobot) and since discobot is TL0, I changed flag post allowed groups to TL0. Still the same error- You are not permitted to view the requested resource.
It’s working now after increasing @discobot to TL1. I’m not sure what the conclusion is- just make sure your user meets both the trust-level and groups-based settings. Even then I can’t explain why it used to work then broke.
Hmm. I’m not sure Glad it’s working now though. I’ve pinged the dev who made the change to see if there’s more to it, but we may wait on more reports to dig deeper now you’ve got yours up and running again.
Well, it worked for a short time- maybe a day. Then @discobot loses his ability to flag again. To be clear, this has nothing to do with the API- if I impersonate @discobot and browse topics, the flag icon is not available. If I then change @discobot’s trust level- even to a lower level- the flag icons appear again. I’ll try to characterize it better, but something seems wrong.
Also I don’t know whether the issue is unique to @discobot. I just use @discobot because he’s the user you’d naturally expect to auto-flag posts. And it worked for years.
I think you may need to check with a different user. There’s some magic that removes Discobot and System from the trust level groups so anything trust level group-based using those users will give you funky results (they currently get re-added each time you update your forum, and then are removed again a short time after).
If you could create a specific test user to try this out with the results will be much clearer.
Glad it’s working now though. 
I’ve pinged the dev who made the change to see if there’s more to it, but we may wait on more reports to dig deeper now you’ve got yours up and running again.