Hello, is the /api/docs/{docId}/sql endpoint expected to require Owner permissions once Access Rules are enabled, even if the authenticated user actually has read permissions on all tables? I haven’t found this limitation documented, but I’ve noticed that the same Service Account with a Viewer role can use the /sql endpoint if access rules are disabled, but receives a 403 error when they are enabled.
The sql endpoint genuinely just runs an sql query, and sql queries aren’t aware of access rules. So you need to have uncomplicated read access to everything before the endpoint will work.
I do have a PR for making the sql endpoint access-rule aware, but it’ll be a while before it can be reviewed: Add /sql/full endpoint: granular read and write with SQL by paulfitz · Pull Request #2225 · gristlabs/grist-core · GitHub
Thank you Paul, that makes perfect sense. This improvement will be very useful for using Service Accounts in client applications. In the meantime, I’ve managed to work around the problem by using tables endpoint and moving tables joins to the client side.