Device has no access to release_tag

In our application (running on the IoT device) we want to show the user the version number of an available update.

As @krix mentioned, it would be nice to be able to give a “version number” to a release.

In the meantime we are trying to get this working with tags, but unfortunately it seems that the API token provided on the device doesn’t have the right to query release_tag:

> curl "https://api.balena-cloud.com/v4/release?\$select=id,commit,created_at&\$expand=release_tag(\$select=tag_key,value)&\$filter=status%20eq%20'success'&\$orderby=created_at%20desc" -H "Content-Type: application/json" -H "Authorization: Bearer $BALENA_API_KEY" 
Unauthorized

If I do the same with a regular user token, it works:

> curl "https://api.balena-cloud.com/v4/release?\$select=id,commit,created_at&\$expand=release_tag(\$select=tag_key,value)&\$filter=status%20eq%20'success'&\$orderby=created_at%20desc" -H "Content-Type: application/json" -H "Authorization: Bearer <my secret token>" | jq .
{
  "d": [
    {
      "release_tag": [
        {
          "tag_key": "version",
          "value": "0.0.1",
          "__metadata": {
            "uri": "/resin/release_tag(undefined)",
            "type": ""
          }
        }
      ],
      "id": 974434,
      "commit": "c4c91a761d78895a8ee2c51148d4a3df87add480",
      "created_at": "2019-06-28T08:38:00.950Z",
      "__metadata": {
        "uri": "/resin/release(974434)",
        "type": ""
      }
    },
...

I see no reason why a device should not have access to release_tag for its own releases (as it has access to release).

1 Like

Hi,
I think this should be fine to allow devices to read release_tags, but I’ll create an internal ticket to discuss this and we will get back with feedback when we have any news.

Thanks for your quick response. I’m looking forward to your feedback. :slight_smile: