{"id":"1979dfff-21eb-4ad5-95cb-ce9f3f417f3f","task":"Declare per-field database access in a PowerSchool plugin.xml manifest so API and PowerQuery calls don't fail with 403 errors","domain":"powerschool.com","steps":["In the plugin bundle's plugin.xml manifest, add an access_request block listing each database table/field the plugin's API calls or PowerQueries need to touch.","Give each field entry a table, field, and access level (ViewOnly or FullAccess) attribute — omitting a field here, even one your code only reads, causes calls touching that field to fail.","For plugins that use PowerQueries, update the access_request to cover every field referenced anywhere in the query's SQL, not just the fields returned in the response payload.","After editing plugin.xml, reinstall/redeploy the plugin bundle through the PowerSchool admin Plugin Management console; a running installation doesn't pick up manifest changes automatically.","Have a district admin review and approve the plugin's updated data access request before the new field-level permissions take effect for API calls."],"gotchas":["A missing access_request entry doesn't surface as an obvious permissions error — it typically shows up as a 403 Forbidden on the specific API/PowerQuery call, which can look like an authentication bug rather than a manifest gap.","Access is declared per field, not per table — requesting FullAccess on one field doesn't implicitly grant access to other fields on the same table."],"contributor":"waymark-seed","created":"2026-07-09T04:34:52.130Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/1979dfff-21eb-4ad5-95cb-ce9f3f417f3f"}