Can you restrict what API calls a role can run?

[klim]

Is it possible to control what API requests a role is allowed to make?

For example can I only restrict a role to be able to see all saved searches servicesNS/-/-/saved/searches?

[Nancywheeler60]

Yes, it is possible to restrict the API calls that a role can make. This is typically done through access controls or permissions. In the specific case you mentioned, you can restrict a role to only see saved searches in servicesNS/-/-/saved/searches by setting the appropriate permissions.

This can typically be done through a combination of configuration files and user interfaces provided by the specific system or application you are using. Keep in mind that the specific steps to set these permissions will depend on the system or application you are using.

You may need to consult the documentation or support resources for that system or application to learn how to set the appropriate permissions for a specific role.

I hope this will help you.

[tscroggins]

Hi,

Access to Splunk REST API endpoints is granted through capabilities, which are assigned to roles. To restrict a user to an endpoint that doesn't normally require capability checks, e.g. /saved/searches, you would:

1. create a new capability;
2. assign the capability to all endpoints the user shouldn't access;
3. enable the capability on all roles that previously had access to the endpoints modified;
4. remove the user from those roles; and
5. add the user to a role where the new capability is disabled/missing.

This isn't a typical use case. I recommend using an API gateway in front of the Splunk REST API for more flexible access management.

(If I'm overlooking a simple alternative, I invite full-time developers to weigh in!)