That makes sense, thanks Becky.
Original Message:
Sent: 11-26-2025 13:33
From: Becky Powell
Subject: OAuth Client Permission Enforcement for User Management APIs
Hi Vaun, we're received feedback directly and through internal teams. Thanks!
------------------------------
Becky Powell
Director, Product Management
Genesys - Employees
Original Message:
Sent: 11-26-2025 13:32
From: Vaun McCarthy
Subject: OAuth Client Permission Enforcement for User Management APIs
Hi Ananya, you mention here having received feedback but I don't see any comments or replies on this post. May I ask you to please point me to where people have given feedback on this change?
------------------------------
Vaun McCarthy
Original Message:
Sent: 11-26-2025 12:10
From: Ananya Singh
Subject: OAuth Client Permission Enforcement for User Management APIs
We appreciate the feedback and understand that the timing of this change has created challenges, especially during a period when many organizations are in change freeze. We want to be transparent about why this update was necessary and clarify the intent behind it.
Nature of the Change
This update addresses a security vulnerability caused by an unintended behavior in how OAuth client permissions were being enforced for user management APIs. In short, some OAuth clients were able to perform actions beyond their defined permissions - a gap that could allow unauthorized access under specific conditions. Correcting this issue is a bug fix, not a functional or feature change, and it should not impact any properly configured OAuth clients.
Reason for Urgency
Because the bug represents a potential security exposure, our security and product engineering teams determined that it was necessary to close the vulnerability as quickly as possible. Leaving it open would risk misuse of customer environments, including unauthorized access and possible fraudulent behavior. As stewards of customer data security, we have a responsibility to act promptly when a vulnerability is identified, even when the timing is not ideal.
Timing and Communication
We acknowledge that the one-week notice period was shorter than normal. Our intent was to balance two competing priorities:
Providing advance notice and documentation to customers; and
Closing the security gap as quickly as possible once the nature of the vulnerability was confirmed.
We are reviewing our internal change management and communication processes to identify ways we can provide earlier notification for security-related fixes while still maintaining responsible disclosure and remediation timelines.
Guidance for Customers
Review OAuth Clients: Confirm that each client has the correct scopes and permissions for the APIs it accesses.
Assess Impact: Most environments should not see any impact. If a client fails due to missing permissions, this indicates it was relying on the unintended behavior that has now been corrected.
Our Broader Commitment
We remain committed to minimizing non-critical changes during peak operational periods such as major holidays. However, when a change is required to protect customer data and platform integrity, we must prioritize mitigation of that risk. This is a shared security responsibility, and we appreciate your partnership and understanding as we maintain the safety and reliability of the Genesys Cloud platform.
cc: @Becky Powell
------------------------------
Ananya Singh
Product Manager
Original Message:
Sent: 11-21-2025 15:17
From: Developer Community
Subject: OAuth Client Permission Enforcement for User Management APIs
Summary
To strengthen platform security and ensure consistent permission enforcement across all user management APIs, we're introducing stricter validation of OAuth client permissions.
After this change, OAuth clients without the required permissions will no longer be able to perform user management actions through the following endpoints:
Endpoint | Impacted Action | Required permissions (ANY of these) | |
POST /api/v2/authorization/divisions/{divisionId}/objects/{objectType} objectType = USER | Move users between divisions | directory:user:edit | |
POST /api/v2/users/{userId}/invite | Send user invites | admin directory:organization:admin directory:user:setPassword | |
PATCH /api/v2/users/{userId} | Update user information | admin directory:user:edit directory:organization:admin | |
PUT /users/{userId}/profile | Update user profile | admin directory:user:edit directory:organization:admin | |
The changes will be applied on or after 01 December 2025.
Effective Date
Monday, December 1, 2025
Details
This update aligns API behavior with platform-wide permission standards and improves overall security posture.
Customer Impact
What You Need to Do
- Review your OAuth client permissions to ensure they include the appropriate scopes before this change takes effect.
- Update automation or integration scripts that rely on these endpoints to prevent failures after enforcement begins.
- Requests made without the correct permissions will now return an HTTP 403 Forbidden error.
Impacted Resources
POST /api/v2/authorization/divisions/{divisionId}/objects/{objectType} (objectType = USER)
POST /api/v2/users/{userId}/invite
PATCH /api/v2/users/{userId}
PUT /users/{userId}/profile
Issue References
PLUG-1002
Contacts
@Ananya Singh
Please reply to this announcement with any questions. This helps the wider developer community benefit from the discussion. We encourage you to use this thread before contacting the designated person directly. Thank you for your understanding.