API returns 403 for private benchmarks/notebooks (owner) and Copy & Edit notebooks

[4kaws]

Bug Report

Three related permission issues confirmed through testing against the Kaggle API.

---

Bug 1 — Owner gets 403 on their own private benchmark leaderboard

get_benchmark_leaderboard returns 403 when called by the benchmark owner.

Repro:

• Create a private benchmark (tested with junesdata/alabala)
• Call kag_client.benchmarks.benchmarks_api_client.get_benchmark_leaderboard(req)
  authenticated as the owner
• Result: 403 Permission 'benchmarkVersions.getLeaderboard' was denied

---

Bug 2 — Owner can't list child tasks of their own private benchmark

kernels_list(parent_kernel=...) returns 403 for the owner of a private benchmark.

Repro:

• Same private benchmark as above
• Call api.kernels_list(parent_kernel="junesdata/alabala")
  authenticated as the owner
• Result: 403 Permission 'kernels.get' was denied

---

Bug 3 — Public notebooks created via "Copy & Edit" are inaccessible via API

Public notebooks created via "Copy & Edit" return Permission 'kernels.get' was denied
on every API call (list_kernel_session_output, kernels_status) despite being
fully visible and accessible on kaggle.com.

Confirmed on two independent benchmarks:

• gpreda/does-llms-know-history — 6/10 tasks affected
• anhoangvo/lemonasso — 5/15 tasks affected

Example notebooks confirmed public on kaggle.com but 403 via API:

• gpreda/byzantine-empire-citizens
• gpreda/fall-of-roman-empire
• anhoangvo/html-art-copy-art
• anhoangvo/html-art-v1-copy-art

Repro:

api.kernels_status("gpreda/byzantine-empire-citizens")
# 403 Permission 'kernels.get' was denied

[stevemessick]

@dolaameng There seems to be a permissions issue with notebooks for benchmark tasks. There is much more info in the related PR #951. Could you check for back-end issues?