Limit API Access to an account

[#1]

Hello

I was wondering if there is a possibility to limit account's access rights in a way that would allow only reading ONE particular schema and nothing else. Either SOAP API or jssp is fine.

Additionally, is it possible to track exactly how often and how much data the user is obtaining with the API calls?

Kind regards

[Amit_Kumar]

Thanks Amit for your thoughts. 

My idea was to create JSSP pages and instead of SOAP Calls allowing POST requests through HTTP, then I believe it would be possible to build some kind of basic tracking on that JSSP, wouldnt it?

[Amit_Kumar]

There is a problem as soon as you give the access to JSSP page, they will automatically get access to SOAP. then the only way you can achieve this is by hard coding the access in JSSP for the user using logonEscalation method or something similar.

[Amit_Kumar]

if you still wants that method then you have to create another schema for monitoring if you want ACC to handle everything in-house. every time there is an invocation to this JSSP page you can create a row there. and log the bytes requested as response and session info.

[szymons55769873]

Amit, I tested a scenario when the IP I whitelisted wasn't given API access rights and I was still able to obtain data from JSSP. A problem only would arise if the user was using an IP that has to have the API enabled.

[Amit_Kumar]

yeah because JSSP sits on web server so anyone can access it as it's in public domain. if you want it like that then sure it will solve your purpose.

[szymons55769873]

Thanks, Amit, would you know how exactly does the "Restriction by folder" option in the account settings in client work? It doesn't seem to work for API which is unfortunate

[Amit_Kumar]

yeah, it's a shame. The Restrict to information found in sub-folders of: option lets you limit the rights attributed to the operator of a folder. Only the subfolders of the node specified in this option will be visible to the user in console. so it will not work for JSSP page.

[szymons55769873]

Amit, do you know if JS server pages have any limitations as such, or is in theory possible to read/write the exact same range of schemas and use all methods that SOAP Call allows?

[Amit_Kumar]

Except for the public domain access security issues, everything else is there. In terms of functionality, you can achieve everything.

[szymons55769873]

But to access the page if logon is required you still need to have your IP whitelisted, which would address most of the vulnerabilities, wouldn't it?