Answers

• Adis Hrnjica Whiz Kid

  September 17

  Hi Randi,
  
  Here are some responses, let me know if you need additional clarification.

  Do all users have API access?

  • No separate API privilege. Any authenticated user can call the API as themselves, with the same rights they have in the UI
  • They need an OAuth2 client and access token first. Users can create their own under User Settings → API Clients; admins manage org-wide clients under System → API Clients
  • Use a user-based client so the token is tied to a user. A no-user Server Application token can only see public content

  How does the API decide what a user can do?

  • Same permissions as the UI, evaluated per folder/video and per action
  • Creator on some content and Viewer on other content: they can edit only the Creator items and only view the rest
  • List APIs only return what that user is allowed to see
  • 401 = not signed in / bad token. 403 = signed in, but not allowed to do that

  Rate limits

  • Default: 5/sec, 100/min, 5,000/hour
  • Counted per OAuth client (and IP), separately per endpoint
  • Over the limit returns HTTP 429. Support can raise these

  Users vs admins

  • Viewer: watch/list shared content
  • Creator: create/edit/share in folders they have Creator on
  • Videographer: manage all content, but not site admin APIs (users/groups/settings)
  • Administrator: full site control, including user and group APIs
  • Content APIs follow folder/video roles. User/group/site APIs generally require Administrator

  I hope this helps.
  
  Thanks,
  
  Adis

  0