Super Admin role required for API requests

[frogstarr78]

Is it expected behavior that the Super Admin role is required for a user to use an API Token?

I have a separate user than myself. API responses come back empty(ish)

{"jsonrpc":"2.0","result":[],"id":1}

If I use my own account, which is a Super admin, without an API Token: https://www.zabbix.com/documentation...authentication the same payload returns a result.

If I convert the user in question, to a Super Admin role, then they can make api requests, both using their username/password and the api token. In fact, after I change their role, they can use the token returned from the user.login method prior to the change even, which seems like a bit of a security issue as well . As soon as I change their role back to Admin role, requests return nothing. They do not fail authentication either, so that's good. I don't see any relevant errors for the requests in the logs. Although, I may not have the necessary log level to see any.

With the user set to the Admin role, the "Access to API" permission IS enabled.

This is for Zabbix 7.4.13 and jsonrpc 2.0.running on Ubuntu 24.04

Any suggestions? Is this known/expected behavior?

[mariusl]

Hello

What methods are you trying to use? Also keep in mind that the user roles control what API access the user gets. Double check that the regular user has a role that gives access to the method you are trying. "Access to API" isn't always sufficient - check the allow or deny list as well.

I think the token is validated on each call, checking what permissions it can use, though i'm not 100% certain. In practice this shouldn't be a security issue if the user role is changed after the token is generated.

[cyber]

Users and admin users fall under the usual access permissions also. If they are not allowed to access data, they do not get any answers to api calls also.

[havien]

Hmm, I've been having the same issue as the original poster but I don't want to get banned. Is this topic ok to talk about?