Is a "Learner" role allowed to update the grades through an API Call?
I'm having trouble trying to make the API call below due to the lack of permissions from "Learner", the scope given is correct but yet the API returns a 403 which is forbidden.
PUT https://learn.build.org/d2l/api/le/1.9/(orgUnitId)/grades/(gradeObjectId)/values/(myGradeValues)
{
"GradeObjectType": 1,
"PointsNumerator": 12
}
User is enrolled into the course and can grab the grade values for it using this API:
https://learn.build.org/d2l/api/le/1.9/(gradeObjectId)/grades/(gradeObjectId)/values/(myGradeValues)
Now, under the Permissions tool, we have enabled the "See the Grades tool, Enter Grades, Manage Grade" for the "Learner" role, but we DON'T actually want the Learner to edit their grades from the Brightspace interface. We just want the "Learner" user to be able to send their grades to Brightspace via an API call.
What is the correct approach to send an API call so that the grade items get updated via the "Learner" role without allowing them to edit their own grades in the Brightspace interface?
Answers
-
I very much doubt it. API permissions tend to mirror GUI permissions so if they can't do it in the GUI they wouldn't be able to do it from the API.
-
Even if you could hide it in the interface, that would be dangerous. Learners can make these API calls themselves if they are logged in, by using Postman (or even Firefox, this is the whole purpose of the API). The documentation is publicly available so it would be very easy to change your own grades if you could do it through the API.
