Least privilege best practice for API user

[mfs]

I interact through the API to selectively enable or disable media notifications for users according to on-call shifts.

I'm using a "Zabbix Super Admin" account to do so, but that poses a security risk. I also don't like the fact that the user and password are hardcoded in the python script that interacts with the API.

How should I create a new user or group so that it can only do what I need it to do and nothing else?

Bonus: how could I avoid hardcoding the password inside the script?

Thank you

[vladimir_lv]

Hi!
You can create a new role, especially for API purposes.
To avoid using passwords use tokens.
Here is a good article about Zabbix security
https://blog.zabbix.com/securing-zab...t-online-2021/