# Owners are not assignable when Group created via API call

**URL:** https://meta.discourse.org/t/owners-are-not-assignable-when-group-created-via-api-call/94913
**Category:** Development
**Created:** [16.Август.2018 19:58:13 UTC](https://meta.discourse.org/t/owners-are-not-assignable-when-group-created-via-api-call/94913 "2018-08-16T19:58:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![typeoneerror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/typeoneerror/32/80817_2.png) [@typeoneerror](https://meta.discourse.org/u/typeoneerror)
#### Post date: [16.Август.2018 19:58:13 UTC](https://meta.discourse.org/t/owners-are-not-assignable-when-group-created-via-api-call/94913/1 "2018-08-16T19:58:13Z")

</div>

**NOTE: please see my second post below for the real issue.**

I am attempting to programatically create groups via the DiscourseApi (ruby gem). The `Groups` module seems to indicate that `owner_usernames` is an optional param:

> <https://github.com/discourse/discourse_api/blob/c8a9724ec32b8344e3547db4bcd3c63eb1277c53/lib/discourse_api/api/groups.rb#L26>

and I’m passing it through as:

```
owner_usernames: ['ben']

```

However the actual request to Discourse is not working because that parameter is not a whitelisted parameter:

```
Processing by Admin::GroupsController#create as JSON
  Parameters: {"group"=>{"full_name"=>"Super Test Group", "mentionable_level"=>"3", "messageable_level"=>"3", "name"=>"super-test-group", "owner_usernames"=>["ben"], "visibility_level"=>"1"}, "api_key"=>"[FILTERED]", "api_username"=>"ben"}
Unpermitted parameter: :owner_usernames. 

```

Is this intentional/by design or should I submit a PR to allow `owner_usernames` to be mass-assigned? For my integration’s purpose, I need the group to be “owned” by the username making the API request.

---

<div class="post-metadata">

### Author: ![typeoneerror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/typeoneerror/32/80817_2.png) [@typeoneerror](https://meta.discourse.org/u/typeoneerror)
#### Post date: [16.Август.2018 20:02:38 UTC](https://meta.discourse.org/t/owners-are-not-assignable-when-group-created-via-api-call/94913/2 "2018-08-16T20:02:38Z")

</div>

Now that I’m looking at Discourse, I see where the `owner_ids` should be being assigned. Still looking at what `user_groups.build` does and where that relationship actually gets saved. I may be misunderstanding it, but it appears that those relationships are never saved, only the `group.save` is called whereas the group\_users are only built [`build`]. Does `group.save` actually call throught to `group.group_users` to persist the relationships?

> <https://github.com/discourse/discourse/blob/main/app/controllers/admin/groups_controller.rb#L45>

It may be that this use-case was missed because most folks create a group first and _then_ assign an owner to it. In this case the group is already persisted and you’re then using `add_owners`?

> <https://github.com/discourse/discourse/blob/main/app/controllers/admin/groups_controller.rb#L84>

If this is the bug I think it is, this would also apply to adding group users (not just owners) within the `#create` method.

---

<div class="post-metadata">

### Author: ![typeoneerror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/typeoneerror/32/80817_2.png) [@typeoneerror](https://meta.discourse.org/u/typeoneerror)
#### Post date: [16.Август.2018 20:26:33 UTC](https://meta.discourse.org/t/owners-are-not-assignable-when-group-created-via-api-call/94913/3 "2018-08-16T20:26:33Z")

</div>

> [@typeoneerror](#):
>
> - users = User.where(username: group\_params[:usernames].split(“,”))

And there it is.

`owner_usernames` and `usernames` should be a comma-delimted string, not an array. Sorry for the false report.

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [16.Август.2018 20:29:16 UTC](https://meta.discourse.org/t/owners-are-not-assignable-when-group-created-via-api-call/94913/4 "2018-08-16T20:29:16Z")

</div>