thread Re: Finer grained permissions for API access? in Archived Discussions (Read Only)

Finer grained permissions for API access?

prgmr — Fri, 13 Mar 2020 18:03:49 GMT

We would like to proactively limit our API access to the information needed to create a transaction in our own billing system.

We really don't want card_details to be accessible to the API, nor do we want it sent in the webhook notifications. We also don't see a need to have access to customer information with the exception of their email address.

Is there any possibility of square adding finer grains permissions for application access? It doesn't help us if those permissions are part of the request - it needs to be set by a policy.

Re: Finer grained permissions for API access?

JustinC — Mon, 16 Mar 2020 22:06:47 GMT

@prgmr Glad to see your first post in the Community!!!

I just double checked for an answer to your question, and I'm afraid the restrictions you're looking to set is not possible. You can limit what OAuth permissions an application has, but it will only affect what API endpoints you can call, not the information you receive.

If you're interested in checking out our OAuth permissions page, click here.

Re: Finer grained permissions for API access?

prgmr — Sat, 21 Mar 2020 01:34:58 GMT

OK. Then how do we officially make a feature request?

Re: Finer grained permissions for API access?

prgmr — Sat, 21 Mar 2020 01:39:42 GMT

We want this as part of defense in depth - if we're going to be offloading our credit card processing to square anyway, it makes sense to limit our own access to what we actually need to operate.

We'd actually appreciate the same limits on the UI as well, but that is much less likely to happen.

Re: Finer grained permissions for API access?

nika — Sun, 22 Mar 2020 16:18:09 GMT

I went ahead and passed this feature request along to our API team @prgmr. Thanks again for sharing your thoughts here.