Api post to update endpoint doesn't take the user_id from the token, but posts in the name of the one who installed the app?

monday Apps & Developers
, , ,
1

With

mutation {
    create_update (item_id: ${itemId}, body: "${body}") {
        id
    }
}`;

I post an update. But the displayed author of this update is not taken from the user_id, nor from the app itself, but apparently from the one who installed the app. Is this something an app can change?

2

hi @Lafisrap

The app runs under the credentials of the person who added the app to the board and this can’t be changed by the app (would be a violation of security). That why you see the “app owner” as the user that posted the update.

1 Like