Overview
Auvik API permissions determine which API resources a user or service account can access and whether the account can only retrieve data or also create, update, or delete supported resources.
Most API categories are read-only. For these categories, the available permission levels may be limited to No access and View or Read.
API categories that support Edit access
The following API categories support Edit access for write operations:
- API – Tenants
- API – Alerts
Edit access may be required to perform supported create, update, or delete operations within those API categories.
Other API categories may be read-only by design. If an API category does not offer an Edit permission, this is expected and cannot be changed through role configuration.
How permissions are applied
An API request is evaluated based on:
- The API category required by the endpoint.
- The permission level assigned to the user or service account.
- The sites, clients, or tenants assigned to that account.
- Whether the requested operation is supported by the endpoint.
A user may be able to read data from an API category but still receive a permission error when attempting a write operation.
Granting Edit access
An Auvik administrator can update the role assigned to the API user or service account:
- Go to Admin > Roles & Permissions.
- Open the applicable role or create a dedicated API role.
- Locate the required API category.
- Set the permission to Edit for:
- API – Tenants, if tenant write operations are required.
- API – Alerts, if alert write operations are required.
- Save the role changes.
- Confirm that the API account has access to the required sites, clients, or tenants.
Grant only the Edit permissions required by the integration.
Verifying permissions
Test permissions in the following order:
- Make a simple read request to confirm that authentication and basic API access work.
- Confirm that the API account can access the intended tenant or site.
- Test the supported write operation with the smallest possible request.
- Confirm that the API returns a successful 2xx response.
Do not test write access against production data unless the operation is intentional and reversible.
Troubleshooting permission errors
A 403 Forbidden response may indicate that:
- The role does not include the required API category.
- The role provides View or Read access when Edit is required.
- The API account is not assigned to the requested tenant or site.
- The endpoint does not support the requested operation.
- The API account is using credentials associated with a different role or user.
If role permissions were recently changed, confirm that the API account is using the expected credentials and that the integration has reloaded its configuration. Generate a replacement API key only if required by the integration or credential-management process.