diff --git a/lms/djangoapps/teams/views.py b/lms/djangoapps/teams/views.py index 59f1387706..718d125050 100644 --- a/lms/djangoapps/teams/views.py +++ b/lms/djangoapps/teams/views.py @@ -734,6 +734,10 @@ class MembershipListView(ExpandableFieldViewMixin, GenericAPIView): specified team. The requesting user must be staff or enrolled in the course associated with the team. + * course_id: Returns membership records only for the specified + course. Username must have access to this course, or else team_id + must be in this course. + * page_size: Number of results to return per page. * page: Page number to retrieve. @@ -781,6 +785,8 @@ class MembershipListView(ExpandableFieldViewMixin, GenericAPIView): If team_id is provided but the team does not exist, a 404 error is returned. + If the specified course_id is invalid, a 404 error is returned. + This endpoint uses 404 error codes to avoid leaking information about team or user existence. Specifically, a 404 error will be returned if a logged in user specifies a team_id for a course @@ -790,6 +796,13 @@ class MembershipListView(ExpandableFieldViewMixin, GenericAPIView): memberships will be filtered to memberships in teams associated with courses that the requesting user is enrolled in. + If the course specified by course_id does not contain the team + specified by team_id, a 400 error is returned. + + If the user is not enrolled in the course specified by course_id, + and does not have staff access to the course, a 400 error is + returned. + **Response Values for POST** Any logged in user enrolled in a course can enroll themselves in a