Skip to content

[RUN4247] Enforce project-level authorization on execution metrics API #1912

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ronaveva wants to merge 2 commits into
base: 4.0.x
Choose a base branch
from
+6 −0
Open

[RUN4247] Enforce project-level authorization on execution metrics API #1912

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c058fb4
Enforce project-level authorization on execution metrics API
ronaveva Aug 3, 2026
7323fd1
Potential fix for pull request finding
fdevans Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/api/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3986,6 +3986,12 @@ See [Listing Running Executions](#listing-running-executions).

Obtain metrics over the result set of an execution query. The query can be issued over all executions on the system, or over the executions of a single project depending on the variant used.

**Authorization required:** `read` access for the `event` resource type in the relevant project(s) — the same access required to read a project's execution history. The metrics are scoped to the projects you are authorized to read:

* When a project is specified — the project variant (`/api/V/project/[PROJECT]/executions/metrics`) or a `project` query parameter — you must have that access on the named project, otherwise the request returns `403 Unauthorized`.
* When `jobIdListFilter` is supplied, you must have that access on every project that owns the referenced jobs, otherwise the request returns `403 Unauthorized`.
* For the global variant (`/api/V/executions/metrics`) with no `project` and no `jobIdListFilter`, the metrics are calculated only over the projects you are authorized to read (not over every project on the system); if you cannot read any projects, the request returns `403 Unauthorized`.

**Request:**

GET /api/29/executions/metrics
Expand Down
Loading