#705 BUG: Service user cannot obtain API token — /tokens/{username} shows “insufficient permissions” Issue created by KshitijPatil98 Description: Creating a user with the Service flag (no global admin) and valid env permissions cannot retrieve an API token from /tokens/{username}. The page returns “user has insufficient permissions.” It’s unclear whether Service users are intended to get tokens, or if the API capability is required but not exposed/assignable post-creation. Steps to Reproduce: 1. Create a user (no global admin), set Service = true (and grant env access: read/query/admin as needed). 2. Log in as a global admin and open /tokens/{that-username} (or try to mint a token for that user). 3. Observe the error: “user has insufficient permissions.” Expected: • Either Service users should be able to obtain API tokens (for automation), or • The UI/CLI should clearly require and allow assigning an API capability, including post-creation. • /tokens/{username} should work for eligible users or provide a precise reason (e.g., “API access not enabled”). Actual: • /tokens/{username} fails with “user has insufficient permissions.” • In the UI, the API toggle is absent/unmodifiable after creation (only Admin/Service visible), so there’s no way to enable API access later. Version: latest (0.4.6) jmpsec/osctrl