Non-Requestable entitlement is requestable via API

[ejeong]

We restricted requestable entitlement by adding query under entitlement type. 

But we found that this entitlement is reqeustable via API. Is this something expected? 

If we apply access query in endpoint, I remember API returned error when trying to make reqeust for that endpoint.

[rushikeshvartak]

which api are you using

[ejeong]

{{url}}/ECM/{{path}}/createrequest

[rushikeshvartak]

Are you able to submit request for same.

[ejeong]

No,,, I can't see the entitlement as it's hidden for that user...

[rushikeshvartak]

Then its working as expected 

[ejeong]

hmm. as that entitlement is not requestable from UI by reqeustable ent query. I am expecting it's not requestable via API as well.

[ejeong]

entitlement_value 1480 is not showing from UI by requestable ent config

But it was successful from API. 

[rushikeshvartak]

Missing validation. raise saviynt freshdesk ticket. I will test in latest version tomorrow and keep you posted