Read-only token: write operations return success:true but changes are silently discarded

[Tang-ZiHan]

When using a read-only collaborator token, PATCH requests to update records return {"code": 200, "success": true, "message": "SUCCESS"} — but the changes are never actually applied. Reading the record back immediately after confirms the values are unchanged.

Expected behavior: Return 403 or {"success": false} with a meaningful error message.

Actual behavior: Returns 200 success, silently discards the write.

Reproduction:

import requests
headers = {"Authorization": "Bearer <read_only_token>", "Content-Type": "application/json"}
resp = requests.patch(
    "https://api.vika.cn/fusion/v1/datasheets/<dst_id>/records",
    headers=headers,
    json={"records": [{"recordId": "<rec_id>", "fields": {"<field>": 99}}]}
)
print(resp.json())  # {"code": 200, "success": True, "message": "SUCCESS"}
# but reading the record back still shows the original value

This is misleading for any application that relies on the API response to confirm a successful write.

[mr-kelly]

Thank you for bringing this up! You are absolutely right—this is indeed a misleading response from the backend API server. While the SDK simply parses what the server returns, the core server should definitely return a 403 Forbidden rather than a 200 Success when a read-only token attempts a write operation. We have recorded this issue and will report it to the backend engineering team for a fix.

[zoe-icu]

This repository is no longer maintained.

Please switch to the compatible APITable Python SDK:
https://github.com/apitable/apitable-sdks/tree/develop/apitable.py

APITable is the open-source version of Vika, and its Python SDK stays API-compatible with vika.py.