Unexpected / teams API response when using OAuth 2.0 token generated from Developer role account

Hi team,

I'm working with the Lucid Chart REST API, specifically on the Teams endpoints, and I’ve observed some unexpected behavior when authenticating via different user roles using OAuth 2.0.

Context:

• I have two Lucid accounts in the same organization:

  1. An Account Owner (admin-level privileges)

  2. Developer Role account (non-admin, added as a tester collaborator in the OAuth 2.0 app)

• I’ve registered an OAuth 2.0 app and generated two separate access tokens via Authorization Code flow, one for each user.

• The developer role account has only teams + offline_access scope authorized, and is a member of only one team. 

Observations:

1. When using the developer’s token without setting the lucid-request-as header:

GET /teams
Authorization: Bearer <developer_token>

→ Returns a list of all teams in the organization, not just the one the developer belongs to.

2. Using the same developer token with:

GET /teams
Authorization: Bearer <developer_token>
lucid-request-as: user

→ Still returns all teams.

3. When trying to request the teams:admin scope with the developer role account:

→ The token request fails due to insufficient privileges, as expected.

Questions:

1. Is this behavior expected when using an access token from a user with the developer role, added as a tester collaborator in the OAuth app?

2. Should the /teams endpoint return all teams in the org for a user that only belongs to one team?

3. How does the lucid-request-as header influence the /teams response in this case?

4. Is there any recommended way to limit /teams results to only those the authenticated user has access to?

Appreciate your guidance to better align our integration with Lucid’s expected API usage.

Thanks!