Solved API permissions not returning correctly

[marc-sky]

Here are my findings:

3CX V20 build 20.0.8.1121. Service Principal apiusername configured per Admin Console → Integrations → API:
Department: DEFAULT
Role: System Owner
3CX Configuration API access enabled
Reproduced with three SPs including one created from scratch with System Owner from creation.

When we try to use it:

POST /connect/token returns 200. The issued JWT contains:
"unique_name": "apiusername",
"role": ["App","Local","SingleCompany","Paid","Enterprise","CallFlowApp"],
"MaxRole": "users"

Diagnostic evidence the role is the actual issue (and not a missing-endpoint problem):
Endpoint Result
GET /xapi/v1/Defs 200 (matches users-tier scope)
GET /xapi/v1/$metadata 200, advertises 115 entity sets including CallHistoryView and Recordings — confirms both endpoints exist on this build
GET /xapi/v1/DoesNotExistProbe 404 — confirms unknown paths return 404, so 403s below are real permission errors
GET /xapi/v1/CallHistoryView 403
GET /xapi/v1/Recordings 403
GET /xapi/v1/MyTokens 403
GET /xapi/v1/ServicePrincipals 403


Question for 3CX: is the Role dropdown on the API screen actually wired to the JWT's MaxRole claim on this build? Selecting "System Owner" produces MaxRole: "users" regardless of Department choice or Service Principal recreation, while the same setting per the docs should grant MaxRole: "owners" and unblock CallHistoryView / Recordings.

Something does not connect and is overriding or failing to set the role with our client/api token.

 

[Evolute IT]

Here are my findings:

3CX V20 build 20.0.8.1121. Service Principal apiusername configured per Admin Console → Integrations → API:
Department: DEFAULT
Role: System Owner
3CX Configuration API access enabled
Reproduced with three SPs including one created from scratch with System Owner from creation.

When we try to use it:

POST /connect/token returns 200. The issued JWT contains:
"unique_name": "apiusername",
"role": ["App","Local","SingleCompany","Paid","Enterprise","CallFlowApp"],
"MaxRole": "users"

Diagnostic evidence the role is the actual issue (and not a missing-endpoint problem):
Endpoint Result
GET /xapi/v1/Defs 200 (matches users-tier scope)
GET /xapi/v1/$metadata 200, advertises 115 entity sets including CallHistoryView and Recordings — confirms both endpoints exist on this build
GET /xapi/v1/DoesNotExistProbe 404 — confirms unknown paths return 404, so 403s below are real permission errors
GET /xapi/v1/CallHistoryView 403
GET /xapi/v1/Recordings 403
GET /xapi/v1/MyTokens 403
GET /xapi/v1/ServicePrincipals 403


Question for 3CX: is the Role dropdown on the API screen actually wired to the JWT's MaxRole claim on this build? Selecting "System Owner" produces MaxRole: "users" regardless of Department choice or Service Principal recreation, while the same setting per the docs should grant MaxRole: "owners" and unblock CallHistoryView / Recordings.

Something does not connect and is overriding or failing to set the role with our client/api token.

Are you using Console Restrictions? If so, it also applies to the API users.

 

[marc-sky]

Are you using Console Restrictions? If so, it also applies to the API users.

Hey!

Thanks that was it. Such a small little oversight.

Cheers