403 Error on History Endpoint for Custom Integration
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 624
Description
### Environment
SaaS (https://sentry.io/)
### Steps to Reproduce
Steps:
Log into a Sentry account associated with the affected custom integration.
Attempt to access the history endpoint (https://sentry.io/api/0/customers/xxx/history/) using the user account credentials.
Confirm whether the user account can access the endpoint without encountering a 403 error.
Next, try to get to that same endpoint using curl or Postman using a user token or an integration token. You should get a 403.
### Expected Result
Custom tooling should be able to access the history endpoint using tokens.
### Actual Result
A user has pointed out that they are encountering a 403 error when attempting to access the history endpoint (https://sentry.io/api/0/customers/{slug}/history/) of the Sentry API using their custom tooling. This issue arose suddenly, causing their monitoring tool, which relies on this API endpoint, to stop functioning properly.
While the user account can still access the endpoint, the Internal Integration token no longer has the necessary permissions.
I have been able to reproduce the same situation with my Org.
A search on that URL returns a result like this:
But a call using a user token or integration token with the necessary permission returns a 403:
### Product Area
APIs
### Link
_No response_
### DSN
_No response_
### Version
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.