starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Ability to create/view an API keys without permission to do so #6944

New Issue
Closed
opened 2025-12-29 19:47:04 +01:00 by adam · 1 comment
adam commented 2025-12-29 19:47:04 +01:00
Owner
Copy Link

Originally created by @dteknet on GitHub (Sep 7, 2022).

NetBox version

v3.3.1

Python version

3.8

Steps to Reproduce

  1. Create a new user with no permissions assigned
  2. Log in as the new user
  3. Open the user's menu on the top right and select API Tokens
  4. Create a new API key

Expected Behavior

Operation is rejected or the "Add a Token" button is not displayed at all if permission to create a new key is not granted.

Observed Behavior

A user can see and create new API tokens despite he doesn't have explicit permission to do so.

Originally created by @dteknet on GitHub (Sep 7, 2022). ### NetBox version v3.3.1 ### Python version 3.8 ### Steps to Reproduce 1. Create a new user with no permissions assigned 2. Log in as the new user 3. Open the user's menu on the top right and select API Tokens 4. Create a new API key ### Expected Behavior Operation is rejected or the "Add a Token" button is not displayed at all if permission to create a new key is not granted. ### Observed Behavior A user can see and create new API tokens despite he doesn't have explicit permission to do so.
adam closed this issue 2025-12-29 19:47:04 +01:00
adam commented 2025-12-29 19:47:04 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 7, 2022):

A user can see and create new API tokens despite he doesn't have explicit permission to do so.

This is intended behavior per #6073 and #8436. It's also noted in the REST API documentation:

All users can create and manage REST API tokens under the user control panel in the UI.

@jeremystretch commented on GitHub (Sep 7, 2022): > A user can see and create new API tokens despite he doesn't have explicit permission to do so. This is intended behavior per #6073 and #8436. It's also noted in the [REST API documentation](https://docs.netbox.dev/en/stable/integrations/rest-api/#tokens): > All users can create and manage REST API tokens under the user control panel in the UI.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6944
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?