Clarification on API Security Roles in Simpro

[Alantod17]

Hi

We have two applications integrated with Simpro using the Resource Owner Flow and the Authorization Code Grant Flow. We need some clarification regarding the required security roles for API access.

For the Resource Owner Flow, our customers set up an API account for us to use. They often ask what security role this API account needs to have, but we haven’t been able to find any documentation specifying the required security roles for the API endpoints we are using. Could you please direct us to the relevant section?

For the Authorization Code Grant Flow, once we receive the client ID and secret from our customer, their staff members will log in using their own accounts. Could you clarify whether API security permissions follow the person who set up the client ID and secret or the person logging in to obtain the token? Additionally, we need to inform our customers about the security roles required for both the person setting up the client ID and secret and the person logging in.

Could you provide us with information on how API endpoints map to security roles in Simpro? Any documentation or guidance would be greatly appreciated.

Looking forward to your response.

[SimproAPITeam]

Hi Alantod17,
The API applications set up has full admin access to Simpro. There is currently no way of restricting access to parts of Simpro for someone who has access through the API.

The security roles configured apply to Simpro Premium.

Regards

[Alantod17]

Hi Alantod17,
The API applications set up has full admin access to Simpro. There is currently no way of restricting access to parts of Simpro for someone who has access through the API.

The security roles configured apply to Simpro Premium.

Regards

Hi, thanks for the information.

Can I please confirm if I’m understanding this correctly:

If UserAdmin (who has full access) sets up the API key for the management team, and User1 (who only has a security role with permission to view quotes) connects using the API flow.

Are you saying that User1 would then gain access to all other parts of the system use API?

If that’s correct, does this behavior apply to all OAuth methods?

[SimproAPITeam]

Hi,
That's correct.

All API application users have full access through the API. This applies to all authorization methods.

Regards