I have a question regarding role-based access management for API authentication in XProtect 2025 R3.
From what I can see, API authentication and usage seem to be limited to administrator accounts. I have a service account that only needs to trigger events in the system, but apart from that, it should not have any additional permissions.
The issue is that if the account is not an administrator, API authentication appears to fail, even when I grant the user Full Control permissions everywhere. This makes it difficult to follow the principle of least privilege and creates a security concern, as the account has to be an admin just to perform a very limited task.
My questions are:
Is API access currently restricted to administrator accounts by design?
Is there a way to allow API authentication for a non-admin user?
Are there any roles, claims, or permissions that specifically control API access?
What is the recommended approach for service accounts that only need to trigger events or perform a small set of automated actions?
Are there any plans to support more granular API permissions in the future?
I would like to avoid using an administrator account for automation tasks if possible and instead grant only the minimum permissions required.
Any advice or best practices would be greatly appreciated.
Which type of event are you trying to trigger and through which API?
Also, which variant of XProtect do you need to run with? On XProtect Corporate you can provide differentiated management rights to roles so you could make a role specifically for your purpose (but might not even be necessary depending on your answer to my first question)
Hello Peter, I am triggering Analytics Events (I created different kinds like Camera Anomaly Minor - Ctiritical, etc..), which then will create the Alarm. I use the Mobotix Hub L3 which should translate to XProtect Professional+ and Version 2025 R3.
Based on the requirements, it does not appear that an admin account should be necessary. Can you obtain the token using the affected user account as described in the requirements section, or does the process fail only when you try to trigger the event with the token that was successfully obtained?
Hello Marc, I tested it today, I created a newly basic user which has access to all cameras and all alarms events. I can get the access token, and also GET /sites, /events etc works.
But if I try to POST an event to /api/rest/v1/events I will always get 401 Unauthorized, until I give the basic user Administrator priviledges.
Hi, I tested this manually and got it working — could you reproduce these steps and confirm they work for you too?
The only permissions I gave the role were:
Overall Security tab on the role → Connect + Read.
Devices tab on the role → the camera(s) used as the event source (e.g. cameras/{id}), with permission.
No admin rights needed. After creating a role, assigning the user to it, and setting just those two things, the same non-admin token got a 202 Accepted on POST /api/rest/v1/events.