Skip to content
Dew

API permissions

A token does only what its permissions allow. Each permission is separate: allowing changes doesn’t allow viewing. Service accounts can hold any of them; personal tokens hold only the files and file requests permissions.

Permissions

Section titled “Permissions”
Permission Lets the system
Files: View and download List its files, see how their links are shared, download them
Files: Upload and share Upload files, change who can open their links, when they expire, and who gets an email
Files: Delete Delete files
File requests: View and download List requests and download the files people sent
File requests: Create and manage Create requests, invite and remind people, change and close requests
File requests: Delete Delete requests and the files received through them
Users: View See users on its domains, their domains and invitations
Users: Manage Add, invite and disable users on its domains other than admins, give them its domains, give their files to someone else
Users: Delete Delete users on its domains other than admins, along with everything they own
Groups: View See groups and their members
Groups: Manage Create groups and change their members. Adding someone to a group gives them that group’s access
Settings: View See domain, email, storage, branding and single sign-on settings (single sign-on needs Pro)
Monitoring: Server status See server health, system logs, license status and alerts
Monitoring: Audit log Read and export the audit log (Enterprise; your plan is under System → System → License)
Monitoring: File activity Read the activity feed: what happens to files and file requests on its domains

Each endpoint in the API reference names the permission it needs. Acting for a user needs no permission of its own.

What tokens can never do

Section titled “What tokens can never do”

Some actions are for people only, whatever the permissions:

  • Creating, changing or revoking tokens and service accounts.
  • Changing any setting.
  • Creating, inviting or managing admins.
  • Choosing which domains a group gives access to.
  • Changing another person’s password, two-step verification or sign-in method.
  • Activating or changing the license.
  • Showing a link’s password.

Errors any call can return

Section titled “Errors any call can return”
What you see What to do
401 with “This API token has expired.” Regenerate a service account token on its page and give the system the new value. Create a new personal token.
401 with “Invalid or missing credentials” The token is wrong or was revoked. Check the Authorization header, or create a new token.
403 with “This API token doesn’t have permission for this action.” Add the permission on the service account’s page.
403 with “This action isn’t available to API tokens.” The action is for people only. Do it in the web app.
403 with “Personal API tokens can’t be used for admin actions.” Calls under /api/admin/ need a service account token.
400 with “Dew-Act-As can’t be used for admin actions.” Leave out the Dew-Act-As header on calls under /api/admin/.
403 with “Admin access is not allowed from this network.” or “Access denied” on /api/admin/… calls The system’s IP address isn’t on the Admin pages IP allowlist. Add it in Settings → General settings → Advanced.
5xx with a ref such as REF-a3f8b2c1 Something failed on the server. Your admin can find the reference in System → System → Error logs.