[PRODUCTION ISSUE] Card permissions not saving.

[steyncd]

Level

Critical

Urgent

Yes

Time reported

June 30 12:21

Describe the issue

When I create a new API token and select the "View and update card code" card permission, it does not seem to save. I can click continue and it seems to save but when I go in again its unsellected and the cards scope is not returned for my oAuth token. Is this a known issue or am I just missing someting?

Why do you think it’s a production incident?

Its happening in production....

Expected behaviour

I expect all the selected permissions to save when createing a new connection or API key

Actual behaviour

it is not saving all the selected permissions...especially card

Additional context

No response

[programmable-banking-community]

Hey @steyncd. Thanks for raising this, and for the clear detail.

Based on what you’ve described:

• you select View and update card code
• continue/save appears successful
• the permission is unselected when you go back in
• the OAuth token does not include the cards scope

That sounds like the permission is not being persisted correctly, rather than a code-side issue.

I’m going to escalate this to the API/platform team to investigate as a production issue.

In the meantime, If the team needs more detail, we’ll reach out to you for safe diagnostic info such as approximate timestamp, browser, and whether this happens on a new connection/API key only or also when editing an existing one.

[steyncd]

Thank you for the prompt response.

Just some context:
I tried this in Chrome and in Edge and it happens for new API keys and when editing existing ones. I also tried to create a new key that only has the "View and update card code" permission and it saves with a message saying it saved successfully but when editing/viewing it it shows that the API Key has no permissions. I have tried enabling and disabling the programmable features on my cards and then retried the saving of the API keys with the permission but with no luck. In every case it seems to save successfully but then when viewed the permission is unchecked again and the cards scope is not returned with the token.

The steps are:

• Creating a new API key, ticking "View and update card code" → Continue appears to succeed →
• Edit API key and then the permission shows it unticked.
• The OAuth token's scope is: accounts balances beneficiarypayments documents.statements documents.taxcertificates transactions transfers — cards is absent, even when I explicitly request scope=cards in the token call.
• Consequently GET /za/v1/cards returns HTTP 403.

[programmable-banking-community]

Hey @steyncd,

Just to confirm a few things - we are trying to replicate the issue on our side:

• There is a limitation that the card scope can only be added on main accounts, where the client is the owner of the account
  -- Are you trying to add the scope to a different account?

[steyncd]

I had my home loan and cash management account selected as well...I'll set up a new key now with only the main accounts and let you know

[steyncd]

Ok, that seemed to work, thank you. If I create an API key and only select my main account then it saves the permission

[programmable-banking-community]

Glad that worked! We’ll also look into adding a clearer warning in the UI for this case, because the current “saved successfully” message is misleading if the card permission isn't applied.

Let me know if there is anything else you need help with :)
-Nick

[steyncd]

Ok cool.

Thank you once again for the quick response and assistance!