Questions for Nick M.

[gbinal]

• Can an agency admin edit any API user?
• Can an agency admin not see any API Backends, even the one they are administering?

[GUI]

Some quick answers, since I'm a stalker (👀) and happened to see this issue...

• Can an agency admin edit any API user? Yes-ish. An admin can edit any API user unless that API user gets assigned a role that's used for controlling access to specific APIs (for example, if the user were granted a role that granted them write permissions to a specific agency's API). If that happens, then only admins from the agency that control that role can edit that user (so Agency X admins can't go editing users that Agency Y has explicitly granted special access to).
  • The behavior of this isn't exactly obvious, so here's some additional thoughts on potential improvements: https://github.com/18F/api.data.gov/issues/315
  • If you have different requirements, that would be great to know.
• Can an agency admin not see any API Backends, even the one they are administering? Agency admins can view and edit any API Backends they've been granted access to. Which API Backends they have permission to is controlled by the API Scopes and Admin Groups (where are things I do need to better document).
  • Basically, if you create a scope with a host of api.agency.gov and a path prefix of /example/, then any admins with permissions to that scope should be able to create or edit any API Backends, as long as their frontend host equals api.agency.gov and the frontend prefix begins with /example/ (but it could also be a more specific path, like /example/foo/). But let me know if any of that doesn't make sense or anything isn't behaving as expected within the admin.

Feel free to give me a holler if there's other questions, or if it's easier to chat through any of this sometime.