#38044 API design: Create API-only users that only have access to Customer-defined Fleet API endpoints - #42352
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review.
Tip: disable this comment in your organization's Code Review settings.
Co-authored-by: Rachael Shaw <r@rachael.wtf>
| | password | string | body | The user's password (required for non-SSO users). | ||
| | global_role | string | body | The role assigned to the user. If `global_role` is specified, `fleets` cannot be specified. For more information, see [manage access](https://fleetdm.com/docs/using-fleet/manage-access). | | ||
| | fleets | array | body | _Available in Fleet Premium_. The fleets and respective roles assigned to the user. Should contain an array of objects in which each object includes the fleet's `id` and the user's `role` on each fleet. If `fleets` is specified, `global_role` cannot be specified. For more information, see [manage access](https://fleetdm.com/docs/using-fleet/manage-access). | | ||
| | api_endpoints | array | body | _Available in Fleet Premium_. A list of `id`s of API endpoints this user will have access to. For available endpoints, see [List API endpoints for API-only user permissions](#list-api-endpoints-for-api-only-user-permissions). | |
There was a problem hiding this comment.
@rachaelshaw
When omitted or empty it means access to ALL, right?
And on the UI we probably want to disable the Save button if the user selected Specific API endpoints but didn't choose any.
There was a problem hiding this comment.
Cood catch 👍 We should make the user select at least one endpoint or "All" before saving
Would it match existing patterns to have this be null if not setting specific endpoints?
|
|
||
| ### Create API-only user | ||
|
|
||
| Creates an API-only user that does not have access to the UI. |
There was a problem hiding this comment.
Maybe worth documenting that this is a global/team admin only endpoint.
| "role": "maintainer" | ||
| } | ||
| ], | ||
| "api_endpoints": [1,5,7,32] |
There was a problem hiding this comment.
@rachaelshaw
I put as a goal on the implementation to make these ids "stable".
Meaning that for all users/customers the ids map to the same endpoints (to ease troubleshooting and reproducing issues).
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
| "updated_at": "0001-01-01T00:00:00Z", | ||
| "id": 5, | ||
| "name": "Jane Doe", | ||
| "email": "janedoe+randomlygeneratedstring@example.com", |
There was a problem hiding this comment.
Just double checking, janedoe is the name of the admin that's creating the API user? Or is the whole email randomly generated?
There was a problem hiding this comment.
yeah that's the admin's email
4 participants
For user story: