When API key has changed origin, actions complete even if the performer does not have access to the reference item
Description
When API key has Performed origin changed, approvals from reference items not available to the performer are still retrieved without issues (GET method) and the other actions (POST, PATCH, DELETE methods) on such approvals do not throw any errors.
Expected behaviour:
-
An approval on a reference the performer cannot see is not included in the GET /approvals response.
-
Actions like create/archive/delete are not completed and the outcome is surfaced as an instance warning.
Ready to deploy
Add watchers
Details
Priority
Created: 14 August 2026, 14:41
Updated:
24 August 2026, 11:47