MMIAC accesscontorl for attachment APi

[priya110]

Hi,

Has anyone configured MIAC (Machine Identity Access Control) for the Attachment API?

I currently have a requirement where an integration account needs access to both a custom scripted REST API on the Incident table and the Attachment API.

I was able to successfully configure the API policy and MIAC for the Incident table. However, I have run into a blocker with the Attachment API because the sys_attachment table is not available in the table selection list.

Has anyone encountered this issue before or found a way to configure MIAC for the Attachment API? Any guidance, recommendations, or relevant documentation would be greatly appreciated.

Thanks in advance.

Hi,

Has anyone configured MIAC (Machine Identity Access Control) for the Attachment API?

I currently have a requirement where an integration account needs access to both a custom scripted REST API on the Incident table and the Attachment API.

I was able to successfully configure the API policy and MIAC for the Incident table. However, I have run into a blocker with the Attachment API because the sys_attachment table is not available in the table selection list.

Has anyone encountered this issue before or found a way to configure MIAC for the Attachment API? Any guidance, recommendations, or relevant documentation would be greatly appreciated.

Thanks in advance.

[rahulswami]

Hi @priya110,

Sys_attachment is not exposed through the standard Table API/scripted REST framework, that is why it never shows up in the MIAC table picker. Here is what to check and try:

First, look at the API Access Policy field itself in your MIAC record, not the table list below it. Check whether Attachment API has its own selectable policy entry there. If it does, that is the actual mechanism for granting access, you do not need sys_attachment in the table list at all.

Second, test the call directly. Since Attachment API requests carry table_name and table_sys_id parameters pointing at the parent record, try an Attachment API call with your integration account once Incident access is already granted through MIAC and see if it succeeds without sys_attachment ever being listed. If authorization is validated against the parent table's ACLs rather than sys_attachment, this will just work.

Third, if the call fails, check sys_restricted_caller_access for an entry tied to sys_attachment and your integration user or application. If you find one sitting in a Requested state, switch it to Allowed. This has resolved similar sys_attachment access issues for scoped applications in other cases.

If all three come up empty, log a HI case referencing MIAC and Attachment API together. This looks like a gap between the two frameworks rather than a missing configuration step on your end and support can confirm whether it is a known limitation.