Skip to main content

Configuration and Maintenance of Permissions

An application can only call authorized APIs. Permission configuration should derive the required scopes from business actions, and evaluate read, write, and high-risk operations separately.

Configuration Principles​

  1. Apply per API: Confirm the required permissions from the specific API page, and do not use a permission with a similar name but a broader scope as a substitute.
  2. Separate read and write: Read-only sync tasks should not be granted permission to create, update, delete, or send.
  3. Split applications by responsibility: When the responsibilities of organization synchronization, email processing, and calendar automation differ significantly, use different applications and credentials.
  4. Test before rollout: Verify new write permissions on test accounts or within controlled organization scopes before moving to production.

Recommended Workflow​

  1. List the APIs, resource scopes, and read/write actions that the application will execute.
  2. Record the required scopes on each API page, then merge and deduplicate.
  3. Have the application owner and email administrator review high-risk permissions.
  4. Update permissions in the application details and save.
  5. Re-acquire the access token and verify read-only, write, and exception paths.
  6. Record the reason for the change, operator, time, verification results, and rollback plan.

Changes and Revocation​

  • After a feature is decommissioned, promptly remove the corresponding permissions. Do not retain scopes that "might be used later".
  • When the responsible person leaves, the system is migrated, or a secret is leaked, first rotate the credentials, then check permissions and access logs.
  • For operations such as sending emails, deleting resources, batch modifications, and quarantine release, add business-side secondary confirmation and audit records.
  • Periodically check the actual called APIs against the authorization list, and clean up permissions that have not been used for multiple consecutive cycles.

Common Issues​

PhenomenonCheck Item
401 UnauthorizedCheck if the token is missing or expired, and whether the Bearer prefix and server are correct.
403 ForbiddenCheck whether the current application has the permissions listed on the API page, and whether the token was re-acquired after updating permissions.
Test works, production failsCheck whether the two environments use different applications, region servers, or resource scopes.
Can read but cannot writeCheck whether only read permissions were granted, and whether the target resource also requires administrator or object-level permissions.

Source: Alibaba Mail User Manual, Alibaba Mail API Open Platform