When using Oneflow’s public API, you can control which permissions are applied to a request by making the request on behalf of a specific Oneflow user.
How do I limit what the API token has access to?
The API token itself is connected to your Oneflow account. To limit a request according to a user's permissions, include the user's email address in the X-Oneflow-User-Email header.
Oneflow will then check what that user is allowed to access. This includes access to workspaces, templates, and contracts.
Which headers do I need to include?
Most API requests use the following two HTTP headers:
-
X-Oneflow-API-Token
Identifies your Oneflow account and is required for all endpoints. -
X-Oneflow-User-Email
Identifies the Oneflow user making the request. Oneflow applies that user's permissions when authorizing the request.
The user must be registered and active in the same Oneflow account as the API token. You can retrieve the users in an account with the Get users in an account endpoint.
How does this work in practice?
Imagine that a user named John does not have permission to access a particular contract.
If you then include John's email address in the X-Oneflow-User-Email header when making a Get a contract request, the request will fail. This prevents the API request from accessing something John would not be allowed to access in Oneflow.
What happens if I don't include a user email?
Requests made without the X-Oneflow-User-Email header are authenticated and authorized as anonymous admin user requests. This means that user-specific permissions are not applied.
To follow the principle of least privilege, include the user email header whenever the endpoint supports it.
For complete technical details, see the authentication and authorization documentation.