What permissions do I need for these PA RE Actions?

Lisa Peoples

Hi, today I discovered there's two Raisers Edge NXT actions I can't run:

Get a constituent by lookup ID (I am using the actual Constituent ID) and

Search for a constituent (enhanced).
I have read/write access (I can create actions and set Inactive status, Recurring Gift statuses).
But something must be missing for me to run these actions. Any ideas? A colleague with complete admin access can run them ok.
Here's the output:

Thank you!

Lisa.

Erik Leaver

Hi @Lisa Peoples - Are you looking up the same constituent in each of these actions? That would rule out any odd record level/security group permission issue for a particular record.

You note another user with full access successfully retrieves records. Are you testing against the same record?

Your error message notes that the response is not in a JSON format. This suggests the issue is not permissions related. I'd wager that the lookup id might be malformed which then returns a value that Power Automate can't read. This can happen with leading/trailing spaces, special characters, or URL-sensitive characters.

I'd test against a few records in parallel with your staffer who has full permissions to see if it's a permissions issue or a formatting issue with the lookup id.

Alex Wong

There are some APIs that's group under "NXT Integration" category of API endpoint that requires "additional" access level (or ADMIN) to run. I'm not sure if this one you are trying to do is or not though.

Have your RE NXT admin check to make sure you have this role assigned to you:

Lisa Peoples

Thanks @Erik Leaver, I'm trying a few different records, and so is my colleague. She can retrieve the same Constituent IDs that I can't. I can retrieve those same records by their System Record ID. But if I don't know it and only have their Constituent ID, I'm stuck.

@Alex Wong thanks for the suggestions, I've passed them on to our dbadmin and hopefully we can try them.

Erik Leaver

@Lisa Peoples I'm assuming you and your colleague been testing in Power Automate.

To confirm this is a permissions issue rather than a Power Automate issue, please take a Cons ID that your colleague can retrieve but that you can't and compare the results using the Try It console with the Get Constituent endpoint.

Given the info you've shared, I'd expect this to work for your colleague & not for you. I'd then review your RENXT roles, Database View security groups and then constituent permissions.

Alex Wong

https://community.blackbaud.com/discussion/comment/316272#Comment_316272

Given what you said, that you are able to retrieve the same constituent record via Get Constituent by system record id, but not able to with Get constituent by lookup id, then it rules out security restriction on the constituent record itself, but more likely your permission to use the get constituent by lookup id endpoint.

So yes, please let us know if you are able get this to work once you are given the user role to run extended API.

I double checked the API reference:

so yes, the specific endpoint to get constituent by constituent id (lookup id, not system record id) is under the NXT Data Integration "hood". This is bar-ed off by the permission setting I posted to you earlier.

@Erik Leaver not sure why this api would be behind more security "bar", something to consider.