# Flagging a post with API broken
**URL:** https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084
**Category:** Development
**Tags:** rest-api
**Created:** [January 9, 2024, 11:17pm UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084 "2024-01-09T23:17:34Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@markschmucker](https://meta.discourse.org/u/markschmucker)
#### Post date: [January 9, 2024, 11:17pm UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/1 "2024-01-09T23:17:34Z")
I flag certain posts using the API and Python. This has worked for several years, until a recent upgrade to 3.2.0.beta4-dev. Now I get `DiscourseClientError: You are not permitted to view the requested resource.` My API key is still valid and is not revoked. Reverse-engineering by flagging a post manually shows the payload for flagging has not changed (except maybe the value of flag\_topic, but that doesn’t seem to matter). Any ideas?
```plaintext
self._post(
"/post_actions",
id=post_id,
post_action_type_id=7, # flag it
message=msg,
flag_topic=True
)
```
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [January 9, 2024, 11:39pm UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/2 "2024-01-09T23:39:10Z")
One recent change to flagging was a move to a group-enabled setting versus a trust level one (`flag post allowed groups`), if that could be connected in some way?
---
### Author:  [@markschmucker](https://meta.discourse.org/u/markschmucker)
#### Post date: [January 10, 2024, 2:58am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/3 "2024-01-10T02:58:51Z")
My settings:
My API key:
So maybe All Users no longer have permission to flag, and I need a new API key for a Single User who does have permission (myself, for instance)? It’s not clear to me what “All Users” means. TL0?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [January 10, 2024, 7:05am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/4 "2024-01-10T07:05:49Z")
Theoretically, as the default of TL1 has stayed the same during the setting swop over, I would have thought the same permissions for the API key would still work, though as it’s now based on group rather than trust level there may be something else having an effect. There was a report of the group’s visibility being a factor in another quirk that cropped up for one of the other settings that’s been moved to the group-allowed format. By any chance, have you changed the visibility of your TL1 group at any point?
---
### Author:  [@markschmucker](https://meta.discourse.org/u/markschmucker)
#### Post date: [January 10, 2024, 7:16am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/6 "2024-01-10T07:16:10Z")
No, all groups are visible.
I’ve also tried with a new API key, this time for a Single User “discobot”, (my webhook runs as user discobot) and since discobot is TL0, I changed `flag post allowed groups` to TL0. Still the same error- `You are not permitted to view the requested resource.`
---
### Author:  [@markschmucker](https://meta.discourse.org/u/markschmucker)
#### Post date: [January 10, 2024, 10:50pm UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/7 "2024-01-10T22:50:45Z")
It’s working now after increasing @discobot to TL1. I’m not sure what the conclusion is- just make sure your user meets both the trust-level and groups-based settings. Even then I can’t explain why it used to work then broke.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [January 11, 2024, 9:50am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/9 "2024-01-11T09:50:38Z")
Hmm. I’m not sure 🤔 Glad it’s working now though. 🙂 I’ve pinged the dev who made the change to see if there’s more to it, but we may wait on more reports to dig deeper now you’ve got yours up and running again.
---
### Author:  [@markschmucker](https://meta.discourse.org/u/markschmucker)
#### Post date: [January 13, 2024, 2:41am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/11 "2024-01-13T02:41:32Z")
Well, it worked for a short time- maybe a day. Then @discobot loses his ability to flag again. To be clear, this has nothing to do with the API- if I impersonate @discobot and browse topics, the flag icon is not available. If I then change @discobot’s trust level- even to a lower level- the flag icons appear again. I’ll try to characterize it better, but something seems wrong.
Also I don’t know whether the issue is unique to @discobot. I just use @discobot because he’s the user you’d naturally expect to auto-flag posts. And it worked for years.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [January 13, 2024, 2:53am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/13 "2024-01-13T02:53:27Z")
I think you may need to check with a different user. There’s some magic that removes Discobot and System from the trust level groups so anything trust level group-based using those users will give you funky results (they currently get re-added each time you update your forum, and then are removed again a short time after).
If you could create a specific test user to try this out with the results will be much clearer.
---
### Author:  [@markschmucker](https://meta.discourse.org/u/markschmucker)
#### Post date: [January 13, 2024, 4:09am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/14 "2024-01-13T04:09:56Z")
OK, I’ve created a specific user to do the flagging via the API. Will see how it goes…
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [February 12, 2024, 4:10am UTC](https://meta.discourse.org/t/flagging-a-post-with-api-broken/291084/15 "2024-02-12T04:10:17Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.