getsentry / getsentry/sentry

403 Error on History Endpoint for Custom Integration

Open
#59,940 2 comments 0 reactions 0 assignees View on GitHub
Bug Product Area: APIs
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
1d 5h
Merged PRs (30d)
624

Description

### Environment

SaaS (https://sentry.io/)

### Steps to Reproduce

Steps:
Log into a Sentry account associated with the affected custom integration.
Attempt to access the history endpoint (https://sentry.io/api/0/customers/xxx/history/) using the user account credentials.
Confirm whether the user account can access the endpoint without encountering a 403 error.

Next, try to get to that same endpoint using curl or Postman using a user token or an integration token. You should get a 403.

### Expected Result

Custom tooling should be able to access the history endpoint using tokens.

### Actual Result

A user has pointed out that they are encountering a 403 error when attempting to access the history endpoint (https://sentry.io/api/0/customers/{slug}/history/) of the Sentry API using their custom tooling. This issue arose suddenly, causing their monitoring tool, which relies on this API endpoint, to stop functioning properly.

While the user account can still access the endpoint, the Internal Integration token no longer has the necessary permissions.

I have been able to reproduce the same situation with my Org.

A search on that URL returns a result like this:
Screenshot 2023-11-14 at 4 51 30 PM

But a call using a user token or integration token with the necessary permission returns a 403:
Screenshot 2023-11-14 at 4 54 24 PM

### Product Area

APIs

### Link

_No response_

### DSN

_No response_

### Version

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.