Conversation
There was a problem hiding this comment.
Pull request overview
Weekly permissions sync updating the permissions-to-API-path mapping for Data Security & Governance content processing endpoints.
Changes:
- Added
/me/.../contentUploadSessionpaths under existingContent.Process.*permissions. - Added
/users/{userId}/.../contentUploadSessionpaths under existingContent.Process.*permissions.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "paths": { | ||
| "/me/dataSecurityAndGovernance/contentUploadSession": "", | ||
| "/me/dataSecurityAndGovernance/processContent": "", | ||
| "/security/dataSecurityAndGovernance/processContentAsync": "least=Application,DelegatedWork", | ||
| "/users/{userId}/dataSecurityAndGovernance/contentUploadSession": "", | ||
| "/users/{userId}/dataSecurityAndGovernance/processContent": "" |
There was a problem hiding this comment.
The new /me/dataSecurityAndGovernance/contentUploadSession path is being added under a pathSet that includes Application schemeKeys and has an empty constraint string. Since /me endpoints are only callable in delegated contexts (no app-only /me), this mapping can incorrectly imply app-only access. Consider moving the /me/... paths into a Delegated-only pathSet or marking them explicitly as delegated-only via the per-path constraint (e.g., least=DelegatedWork).
| "paths": { | ||
| "/me/dataSecurityAndGovernance/contentUploadSession": "", | ||
| "/me/dataSecurityAndGovernance/processContent": "least=Application,DelegatedWork", | ||
| "/users/{userId}/dataSecurityAndGovernance/contentUploadSession": "", |
There was a problem hiding this comment.
In Content.Process.User, the /me/... paths (/me/dataSecurityAndGovernance/contentUploadSession and /me/dataSecurityAndGovernance/processContent) are currently modeled in a pathSet that includes Application and even explicitly marks /me/.../processContent as least=Application,DelegatedWork. Because /me is not usable with app-only auth, please restrict these /me paths to delegated-only (separate Delegated pathSet or delegated-only constraint) so the permissions mapping doesn’t suggest unsupported app-only access.
Weekly Permissions sync 2026-03-31