Auto Approve of requests submitted through API

[engelbrechtd]

Description

1. When submitting requests for a movie or TV show using the API, it auto approves the request regardless of the user's Auto Approve permissions.
2. If the Request permission is removed, it denies the request as expected using the API.
3. Using the Web UI, requests with associated permissions (Requests and Auto Approve), works as expected.

Version

1.34.0

Steps to Reproduce

1.1 Send a PUT request via API using the /request endpoint with the auto approve permissions in place.
1.2 Send a PUT request via API using the /request endpoint with the auto approve permissions removed.
2. Send a PUT request via API using the /request endpoint with the requests permission removed.
3. Submitting requests through the Web UI with auto approve in place or removed works as expected.

Screenshots

No response

Logs

Platform

desktop

Device

Windows PC

Operating System

Windows 11 25H2

Browser

Edge, Postman, Bruno, JS

Additional Context

No response

Code of Conduct

• I agree to follow Overseerr's Code of Conduct

[engelbho]

Having the same issue

[fallenbagel]

Hi @engelbho @engelbrechtd while this repo is no longer maintained (https://github.com/seerr-team/seer), I wanted to explain how the API works.

This is not a bug. This is intended behaviour. API KEY always acts as a superuser. Requesting via api using the API KEY would result in the request being auto-approved as it's treated as a superuser requesting on behalf of another user. To achieve what you desire, you need to use cookies based auth when requesting, which will treat it as users. This is how the web client works too (web client also communicates to the server via the same api endpoints). This is the intended design for how requests work in seerr (previously overseerr/jellyseerr).

[engelbrechtd]

Hi *fallenbagel, *thank you so much for your reply. And again, I dont want to take advantage of the good work and the love that went into this application. I was just relying on the API documentation. from my understanding reading the documentation, it will honour the permissions of the provided userId whether it will auto_approve or not. But thank you for the clarification. [image: image.png]

…

On Mon, Feb 9, 2026 at 7:17 PM fallenbagel ***@***.***> wrote: *fallenbagel* left a comment (sct/overseerr#4324) <#4324 (comment)> Hi @engelbho <https://github.com/engelbho> @engelbrechtd <https://github.com/engelbrechtd> while this repo is no longer maintained (https://github.com/seerr-team/seer), I wanted to explain how the API works. This is not a bug. This is intended behaviour. API KEY always acts as a superuser. Requesting via api using the API KEY would result in the request being auto-approved as it's treated as a superuser requesting on behalf of another user. To achieve what you desire, you need to use cookies based auth when requesting, which will treat it as users. This is how the web client works too (web client also communicates to the server via the same api endpoints). This is the intended design for how requests work in seerr (previously overseerr/jellyseerr). — Reply to this email directly, view it on GitHub <#4324 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADRKXEOL6CYZUBW7OPARQLD4LC6FDAVCNFSM6AAAAACSAI63NOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNZSGU3TMMBZGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- *darrell engelbrecht* *//* angelbright *//* *e* ***@***.*** *//* *w* www.angelbright.co.za *//* johannesburg *//* south africa -- reach high, for stars lie hidden in your soul. dream deep, for every dream precedes the goal *-pamela vaull*

[fallenbagel]

Hi *fallenbagel, *thank you so much for your reply. And again, I dont want
to take advantage of the good work and the love that went into this
application. I was just relying on the API documentation.

from my understanding reading the documentation, it will honour the
permissions of the provided userId whether it will auto_approve or not. But
thank you for the clarification.

[image: image.png]

On Mon, Feb 9, 2026 at 7:17 PM fallenbagel @.***> wrote:

fallenbagel left a comment (#4324)
#4324 (comment)

Hi @engelbho https://github.com/engelbho @engelbrechtd
https://github.com/engelbrechtd while this repo is no longer maintained
(https://github.com/seerr-team/seer), I wanted to explain how the API
works.

This is not a bug. This is intended behaviour. API KEY always acts as a
superuser. Requesting via api using the API KEY would result in the request
being auto-approved as it's treated as a superuser requesting on behalf of
another user. To achieve what you desire, you need to use cookies based
auth when requesting, which will treat it as users. This is how the web
client works too (web client also communicates to the server via the same
api endpoints). This is the intended design for how requests work in seerr
(previously overseerr/jellyseerr).

—
Reply to this email directly, view it on GitHub
#4324 (comment),
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ADRKXEOL6CYZUBW7OPARQLD4LC6FDAVCNFSM6AAAAACSAI63NOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNZSGU3TMMBZGM
.
You are receiving this because you were mentioned.Message ID:
@.***>

--
darrell engelbrecht // angelbright // e @.***
// w www.angelbright.co.za // johannesburg // south africa

reach high, for stars lie hidden in your soul. dream deep, for every dream
precedes the goal -pamela vaull

Nope the api documentation is correct too. Adding a userId to requests is the same as when you on web client you know how when you request as an admin you get to select who you request as? That's the same thing. When you authenticate via cookie auth, you dont need this userId passed in either. It's an optional field. However, we could make it a bit more clear in the openapi spec with a tip yeah