What permissions are needed to create an api using the REST API?

Question

Using wso2am-2.1.0 we'd like to create an API using the REST services, such as /api/am/publisher/v0.11/apis

To use the services to search, create and publish an API the access token needs scope apim:api_view apim:api_createapim:api_publish

Seeing the publisher-api.yaml seems the full admin role is required to access these services.

We woudn't like to use the main admin user used by the services risking compromise of a user account with all privileges and mainly the admin user.

Assigning a different user to the admin role doesn't seem to work, tokens created don't hold necessary requested scopes (subsequence calls to the publisher's servicess causes 401 Unauthenticated request). Im I missing something?

Bee Bee · Accepted Answer · 2017-12-20T17:06:08

It should work. I just did it and here is the output.

bhathiya@bhathiya-x1:/data/products/am/resources$ curl -X POST -H "Authorization: Basic YWRtaW46YWRtaW4=" -H "Content-Type: application/json" -d @payload.json https://localhost:9443/client-registration/v0.11/register -k
{"clientId":"ryUqrib4UAiKtbEt8_HxadTcubYa","clientName":"admin_rest_api_publisher","callBackURL":"www.google.lk","clientSecret":"Q1sTqqd175da8fLaESY6z9h5nuca","isSaasApplication":true,"appOwner":"admin","jsonString":"{\"grant_types\":\"password refresh_token\",\"redirect_uris\":\"www.google.lk\",\"client_name\":\"admin_rest_api_publisher\"}"}
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 22:29:11
bhathiya@bhathiya-x1:/data/products/am/resources$ curl -k -d "grant_type=password&username=bhathiya&password=admins&scope=apim:api_view apim:api_create" -u ryUqrib4UAiKtbEt8_HxadTcubYa:Q1sTqqd175da8fLaESY6z9h5nuca https://localhost:8243/token
{"access_token":"1e3f7460-e186-3ded-b4d9-c093e1ceb9df","refresh_token":"be66fe42-2d34-3a34-8576-f7e24388be00","scope":"apim:api_create apim:api_view","token_type":"Bearer","expires_in":3600}

And you can also change roles in publisher-api.yaml.

What permissions are needed to create an api using the REST API?

1 Answers