Scenario #5004: Reject New Mailinglist Created by Normal User

Properties

Given

name value
partnerPersonTradeName First GmbH
subscriberFamilyName Firby
subscriberGivenName Susan
subscriberEMailAddress contact-admin@firstcontact.example.com
mailingList first-gmbh-internal

Person: First GmbH

HTTP GET "/api/hs/office/persons?name=First+GmbH" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<tst-person_firbysusan>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "63b26b7f-9bc0-4f20-a954-5b6f52f8df23",
  "personType" : "LEGAL_PERSON",
  "tradeName" : "First GmbH",
  "salutation" : null,
  "title" : null,
  "givenName" : null,
  "familyName" : null
} ]

In production, data this query could result in multiple outputs. In that case, you have to find out which is the right one.

Person: Susan Firby

HTTP GET "/api/hs/office/persons?name=Firby" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<tst-person_firbysusan>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "5741580a-f024-47f6-916b-e307212f082e",
  "personType" : "NATURAL_PERSON",
  "tradeName" : null,
  "salutation" : null,
  "title" : null,
  "givenName" : "Susan",
  "familyName" : "Firby"
} ]

In real scenarios there are most likely multiple results and you have to choose the right one.

Contact: contact-admin@firstcontact.example.com

HTTP GET "/api/hs/office/contacts?emailAddress=contact-admin@firstcontact.example.com" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<tst-person_firbysusan>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "32e7083d-6ab9-4a0d-90ea-ca695082d0c7",
  "caption" : "first contact",
  "postalAddress" : {
    "country" : "Germany"
  },
  "emailAddresses" : {
    "main" : "contact-admin@firstcontact.example.com"
  },
  "phoneNumbers" : {
    "phone_office" : "+49 123 1234567"
  }
} ]

In real scenarios there are most likely multiple results and you have to choose the right one.

Subscribe Susan Firby to first-gmbh-internal

HTTP POST "/api/hs/office/relations" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<tst-person_firbysusan>"` \
  `# }` \
  <<EOF
{
  "type" : "SUBSCRIBER",
  "mark" : "first-gmbh-internal",
  "anchor.uuid" : "63b26b7f-9bc0-4f20-a954-5b6f52f8df23", // Person: First GmbH
  "holder.uuid" : "5741580a-f024-47f6-916b-e307212f082e", // Person: Susan Firby
  "contact.uuid" : "32e7083d-6ab9-4a0d-90ea-ca695082d0c7" // Contact: contact-admin@firstcontact.example.com
}
EOF
=> status: 403 FORBIDDEN 
{
  "timestamp" : "2026-08-10 03:08:33",
  "path" : "",
  "statusCode" : 403,
  "statusPhrase" : "Forbidden",
  "message" : "ERROR: [403] new mark \"first-gmbh-internal\" for relation-type SUBSCRIBER may only be introduced by a global admin"
}

generated on 2026-08-10 03:08:33 for branch HEAD