okta.appGrants.read scope requires Super Admin

Questions
1

Hello, I am developing an app that fetches a list of application OAuth 2.0 grants using the “/apps/{id}/grants” endpoint. I am always getting the error 403 (Forbidden) from the API, even though I assigned this app the “okta.appGrants.read” grant, the built-in “Read-only Administrator” role, and a custom role assigned the “View roles, resources, and admin assignments” permission over a resource set containing “All Identity and Access Management resources”.

Not even the built-in App Admin role seems to be sufficient. The issue only disappears if I assign the app the Super Admin role, but this is IMO an overkill for read-only operations and violates the principle of least privilege.

Is there please a viable way of delegating the permission to read application grants, without assigning the app the Super Admin role? I would expect the built-in “Read-only Administrator” role to be assigned the “okta.appGrants.read” permission. Or is this a gap/bug in the current RBAC model?

2

This is expected behaviour rather than a bug: GET /api/v1/apps/{id}/grants requires Super Admin, and there is no way to delegate it to a lesser role today.

3

Can the docs be updated to reference this?

It is very confusing to read the API docs that appear to state you can simply request/grant the scope to your app - only to find out that you need Super Admin and granting this scope, in effect, does nothing for the application being created.

4

It is very confusing that a very high privileged role like that is needed. At least the read only administrator should be valid.

The same thing happens when listing apps. Admin console app is hidden in the response if the request is performed from a non super admin… very weird.

5

Is it possible to ask for a request change for this feature/behaviour? Thank you very much.