Unable to Access OpenCRE Google Sheet – Permission Denied

[althunibat]

Hi OpenCRE team,

We’ve been trying to access the spreadsheet at:

https://docs.google.com/spreadsheets/d/1eZOEYgts7d_-Dr-1oAbogPfzBLh6511b58pX3b59kvg

We followed the instructions and attempted access using valid OAuth desktop app credentials, but we continue to receive a 403: The caller does not have permission error.

Could you please either:
• Share read-only access to the sheet, or
• Provide a static export (preferably in JSON)?

Thank you!

[northdpole]

To get the same info in your local database try the upstream sync cli option.
Thank you for using opencre!

[paoga87]

@northdpole what are we expecting as the results when running make upstream-sync? When I run it following the instructions from https://github.com/OWASP/OpenCRE/blob/main/docs/developmentSetup.md, I get the following error:

sqlalchemy.exc.OperationalError: (sqlite3.OperationalError) no such table: cre
[SQL: SELECT cre.id AS cre_id
FROM cre]
(Background on this error at: https://sqlalche.me/e/20/e3q8)

[northdpole]

You need to run migrations first
Make migrate-upgrade

[paoga87]

@northdpole I had run make migrate-upgrade first... that's why it was odd getting the error above.

[northdpole]

Hi @althunibat — thanks for raising this, and thanks @paoga87 for trying the upstream path.

You do not need access to the Google Sheet. That spreadsheet is an internal maintainer workflow for bulk standards imports. For contributors and local development, the supported path is:

1. Pull the OpenCRE graph from upstream (public API → local DB)
2. Import your own mappings via MyOpenCRE (CSV upload against your local instance)

---

1. Get a local database from upstream

Setup guide: https://github.com/OWASP/OpenCRE/blob/main/docs/developmentSetup.md

Typical first-time flow from repo root:

make install
make migrate-upgrade          # create schema first (required)
make upstream-sync            # downloads the CRE graph from https://opencre.org via REST

That uses python cre.py --upstream_sync, which pulls root CREs and linked data from the public API (/rest/v1/root_cres, /rest/v1/id/{creid}) into standards_cache.sqlite by default.

If you see no such table: cre during upstream sync, migrations were not applied yet — run make migrate-upgrade first (as noted in the thread).

Optional: point at a different upstream with CRE_UPSTREAM_API_URL (defaults to https://opencre.org/rest/v1).

Then start services and the app locally:

make start-containers   # Redis + Neo4j
make dev-flask          # backend (default http://localhost:5000)
# in application/frontend: yarn start  → http://localhost:9001

---

2. Import your own standard mappings (MyOpenCRE)

MyOpenCRE is for mapping your standard (e.g. SOC2, internal controls) to existing CREs — not for re-importing OWASP’s bulk sheet data.

• UI (local dev): open MyOpenCRE in the frontend after yarn start
• Download a CSV template: GET /rest/v1/cre_csv
• Upload your CSV: POST /rest/v1/cre_csv_import with multipart field cre_csv

Imports are disabled on opencre.org; run locally with:

export CRE_ALLOW_IMPORT=true
make dev-flask

Optional query params on import: calculate_embeddings, calculate_gap_analysis.

API overview: https://www.opencre.org/rest/v1/openapi.yaml

---

Summary

Goal	Use
Local copy of OpenCRE data	make migrate-upgrade → make upstream-sync
Map your own standard to CREs	MyOpenCRE UI or POST /rest/v1/cre_csv_import (local + CRE_ALLOW_IMPORT=true)
Google Sheet	Not needed for this workflow

Contributing guidelines: https://github.com/OWASP/OpenCRE/blob/main/CONTRIBUTING.md

Hope that unblocks you — shout if upstream sync still fails after migrations and we can dig into the exact error.

[Bornunique911]

Hi @northdpole, I looked into this issue and confirmed the current docs still leave a gap around the supported local contributor workflow.

I’ve started a small docs-only fix to clarify that contributors do not need Google Sheet access for normal development, and that the supported path is:

• make migrate-upgrade
• make upstream-sync
• optional local MyOpenCRE / CSV import flow when needed

If that sounds good, I can open a focused PR for #599.

[northdpole]

Thanks @Bornunique911 — yes, please open a focused docs-only PR for #599.

Scope that would help most:

1. In docs/developmentSetup.md (and briefly in README.md): state clearly that Google Sheet access is not required for normal contributor setup.
2. Document the supported path: make migrate-upgrade → make upstream-sync, then local run.
3. Optionally note MyOpenCRE / CSV import for mapping your own standard locally (CRE_ALLOW_IMPORT=true).
4. Label --from_spreadsheet / gspread as a maintainer workflow, not the default contributor path.

Please keep it docs-only (no code changes). Happy to review.

[Bornunique911]

Thanks! I'll keep the scope limited to documentation only.

I'll update "docs/developmentSetup.md" and add a brief note in "README.md" to:

• clarify that Google Sheet access isn't required for the normal contributor workflow,
• document the supported "make migrate-upgrade" → "make upstream-sync" setup,
• mention the optional MyOpenCRE / CSV import flow ("CRE_ALLOW_IMPORT=true") for local mappings, and
• clearly distinguish the spreadsheet/gspread workflow as maintainer-only.

I'll open a focused PR for #599 shortly. Thanks for the guidance!