Restrict the API access to only GET Method

[Lucky1]

Hello all,

Good day!

I got a task to create a table API on task table and then create a user for this where I can use this account for authentication.

So, the user should be able to only Get the task data, like Incident or Change requests or Catalog tasks data but he should not be able to update or delete the data in those tables.

(the user should only be able to read the data but not modify it)

So, can someone provide me the steps to achieve this please?

Regards,

Lucky

[Robert H]

Hello @Lucky1 ,

Please assign the role snc_read_only to the user account that is querying the API. It will ensure that this account has only read access.

Example of trying to change data while this role is assigned:

Regards,

Robert

[Chaitanya ILCR]

Hi @Lucky1 ,

adding snc_read_only fulfils your requirement,

I have tested this and is working 

*** Script: 403
*** Script: {"error":{"message":"Operation Failed","detail":"ACL Exception Update Failed due to security constraints"},"status":"failure"}

Please mark my answer as helpful/correct if it resolves your query.

Regards,
Chaitanya

[Lucky1]

Hello Chaitanya and Robert,

Yes, this is working fine.

Can you give me any idea on the below one also please?

I have created a user and assigned hin snc_read_only role.

Now if I want the same user to pull the records from other tables as well like, Transaction log table, it is not allowing me from Postman.

So, here how can I proceed?

Regards,

Lucky

[Ankur Bawiskar]

@Lucky1 

transaction log etc are system table so the access might be different one

[Chaitanya ILCR]

Hi @Lucky1 ,

Give the roles to the user which gives access to those tables 

for example itil role for incident problem change and request etc

in the similar way give the user the role which give access to transaction log table check the acls and give proper role 

with snc_read_only it make sure that account has only read only access even if you were to give admin access(not recommending it just saying)

Please mark my answer as helpful/correct if it resolves your query.

Regards,
Chaitanya