/users/me doesn't return all the profile attributes

Questions API
1

Has anybody experienced the same or know the explanation to the followings:

  • when I use API to get a user profile with /api/v1/users/{{user_id}} as admin user, I get all the attributes from the profile
  • when I use CORS API to get my profile with /api/v1/users/me as admin user, I get all (I think, haven’t thoroughly checked) the attributes from the profile
  • when I use CORS API to get my profile as non-admin user, I get only subset of attributes, while other ones (even populated) are not sent back in a response
2

This seems to work as intended?
When calling the Okta API with a token (which you can generate through the UI), the user who generated the token permission’s are token over. It also checks the user’s current permission so if the user lost admin for example the token basically becomes useless.

This is why it is a good idea to let service accounts generate API tokens.

3

I’m talking here about CORS calls, made from the browser. Those ones do not use API token