Skip to content

docs: Difference in permission behavior between Tasklist V1 and V2 APIs for CREATE_PROCESS_INSTANCE on PROCESS_DEFINITION #6964

@esraagamal6

Description

@esraagamal6

Description:
When the CREATE_PROCESS_INSTANCE permission is granted on the PROCESS_DEFINITION resource type, Tasklist V1 and V2 APIs show different behaviors:

  • Tasklist V1 API:
    The user can see the process on Tasklist when CREATE_PROCESS_INSTANCE is granted.
    This is because the V1 API request uses:

  • Tasklist V2 API:
    The user cannot see the process on Tasklist with only CREATE_PROCESS_INSTANCE permission.
    V2 instead searches for processes using READ_PROCESS_DEFINITION permission.

This difference leads to inconsistent user experiences depending on which Tasklist API version is used.

tasklistV1.mov
tasklistV2.1.mov

Expected behavior:
The permission requirements and resulting visibility of processes on Tasklist should be clearly documented for both V1 and V2 APIs.

Proposed documentation updates:

References:
slack thread

related to:
#6477

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status

    🆕 Inbox

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions