Can you restrict what API calls a role can run?

Path Finder

Is it possible to control what API requests a role is allowed to make?

For example can I only restrict a role to be able to see all saved searches servicesNS/-/-/saved/searches?

Labels (1)
0 Karma


Yes, it is possible to restrict the API calls that a role can make. This is typically done through access controls or permissions. In the specific case you mentioned, you can restrict a role to only see saved searches in servicesNS/-/-/saved/searches by setting the appropriate permissions.

This can typically be done through a combination of configuration files and user interfaces provided by the specific system or application you are using. Keep in mind that the specific steps to set these permissions will depend on the system or application you are using.

You may need to consult the documentation or support resources for that system or application to learn how to set the appropriate permissions for a specific role.

I hope this will help you.

0 Karma



Access to Splunk REST API endpoints is granted through capabilities, which are assigned to roles. To restrict a user to an endpoint that doesn't normally require capability checks, e.g. /saved/searches, you would:

  1. create a new capability;
  2. assign the capability to all endpoints the user shouldn't access;
  3. enable the capability on all roles that previously had access to the endpoints modified;
  4. remove the user from those roles; and
  5. add the user to a role where the new capability is disabled/missing.

This isn't a typical use case. I recommend using an API gateway in front of the Splunk REST API for more flexible access management.

(If I'm overlooking a simple alternative, I invite full-time developers to weigh in!)

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...