Separating zabbix API

[zabbixfk]

Is there any way to separate API from frontend?
i.e limiting access to API's users - API's hitting different instance than zabbix_server running, and differnet frontend.

Thanks

[kloczek]

Just use different base URL of the zabbix GW in the API call.

[zabbixfk]

Thanks for the reply kloczek .
I don't have different zabbix gateways. How do you think i can achieve this ?
Existing setup - FrontEnd and Engine sitting in one box. Same box has Database in it. I have kept a replication slave (mySQL), and i want API requests to go to replication slave not hit the main database.

Does API require zabbix_server or front end to run together? or can i copy only api file and serve it from different box and point it to slave ?

Proposed aproach post upgrading from 3 to 4 version - FrontEnd and Engine in one box. Database in another box. Replication slave in third box.

Thanks,

[kloczek]

Just add another http server with zabbix web frontend application and use it for api calls.

[zabbixfk]

Thanks for the reply. But it will talk to DB right, which DB should i be pointing to, what is this frontend starts changing things on slave? How to serve only api page ( restrict )

[kloczek]

Some API calls are changing database content which means that API GW should not be used against slave DB.

[zabbixfk]

Thanks for the reply @kloczek.
So - i will need to have two servers with httpd plus zabbix folder copied, where one is speaking to master db with users accessing, and other speaking to slave DB for API purpose right?
BTW how can i restrict only specific users to have access to APIs?

Thanks

[kloczek]

I'm not sure what you need because I do not understand your needs about API calls separation.
In zabbix API access is done on each user access permissions layer.

[zabbixfk]

Today - whoever has user creds can get into API. My question was, more on limiting this feature. Other than renaming API access page, is there any way to do this?

[kloczek]

API it is only method of accessing to the monitoring data.
It provides exactly the same viability of the same monitoring data and meta data as over web frontend.

[zabbixfk]

Yes, this is by desgin. My question was more on, just because someone has access to frontend - doesn't need to be on API - is there any way to separate both or restrict, looks like for now there isn't any way.
Thank you again for your clarifications