Limit API key permissions | Voters

Limit API key permissions

under review

Eemil

I would like to create an API key which has limited access within service automation. As far as I can see, that's currently not possible.

I would like to either A) assign a role to an API key or B) create an API key which impersonates a specific user.

December 20, 2022

Iman Peeman

Any Progress on this? With all regulation related to ISO 27001 and NEN7510 which require scoped and only access to functionality a client (or system) really needs, the api cannot be used.

Michiel van der Veeken

marked this post as

under review

Benjamin Fresco

In addition to above mentioned, I would also like to limit the possibilities of what a user can do with a specific API key i.e. to limit a specific key pair to only perform GET requests in HID and not be allowed to send POST-requests.

Per my understanding, In the current implementation of HellloID a entity with a valid API key is not restricted in what it can or cannot do against the API.