Token Permission Discrepancy in XAPI Between Postman and curl/CFD

[smarin]

Hi everyone,

I'm running into an unexpected issue while testing the XAPI and would appreciate any insights.

• When I request the access token using Postman, it returns with system owner permissions.
• However, when I make the same request via CFD or curl, the token comes back with user permissions.

I only have one client ID configured in the system, and it’s assigned the system owner role.

Has anyone encountered something similar? Could this be related to differences in how headers, environments, or authentication flows are handled between Postman and curl/CFD?

Any suggestions or ideas to help troubleshoot this would be greatly appreciated.

Thanks in advance!

 

[paulodagraca]

Hello @smarin ,

What do you mean with "the token comes back with user permissions".
Comes back where?

Paulo

 

[smarin]

Hi Paulo,

Thanks for your reply.

What I mean is that when I make the token request via curl or CFD, I decode the returned token using https://www.jwt.io, and the permissions shown are for a user role.

However, when I make the same request using Postman, the decoded token shows system owner permissions.

That’s why I’m confused — I’m using the same client ID, which is configured with the system owner role, but the resulting token seems to vary depending on the tool used to make the request.

Any idea what could be causing this difference?

 

[paulodagraca]

Hello @smarin ,

Could you share the CURL line that you use, to see what could be wrong ?

I mostly do use PHP or Python, and checked 3 of my eamples, but all get OWNER rights.

When I try to authenticate with user deatils, I would use:
POST message

url = "https://" + serverFQDN + "/webclient/api/Login/GetAccessToken"
headers = {"Content-Type": "application/json; charset=utf-8"}
data = {"SecurityCode":"", "Username":userName, "Password":passWord}

Paulo

 

[paulodagraca]

Hello @smarin ,

When I convert this to CURL,then this should be the one line of code:

curl -s -X POST "https://www.mywebsite.com/webclient/api/Login/GetAccessToken" -H "Content-Type: application/json; charset=utf-8" -d '{"SecurityCode":"", "Username":"MyUsername", "Password":"MyPassword"}' | jq -r '.Token.access_token'

Paulo

 

[smarin]

Hello Paulo,

I follow this documentation about v20 xapi https://www.3cx.com/docs/configuration-rest-api-endpoints/

Send this line:
curl -X POST "https://fqdn/connect/token" -H "Content-Type: application/x-www-form-urlencoded" -d "client_id=myuser" -d "client_secret=mypassword" -d "grant_type=client_credentials"

and receive token "MaxRole": "users"

When send via postman receive token "MaxRole": "system_owners",



Thanks!

 

[KyriacosS_3CX]

Hello Paulo,

I refer this documentation about v20 xapi https://www.3cx.com/docs/configuration-rest-api-endpoints/

Send this line:
curl -X POST "https://FQDNORT/connect/token" -H "Content-Type: application/x-www-form-urlencoded" -d "client_id=user" -d "client_secret=mysecret" -d "grant_type=client_credentials"

and receive token "MaxRole": "users"

When send via postman receive token "MaxRole": "system_owners",

View attachment 49443

Thanks!

Hi,

Are the two requests from the same source IP? Do you have console restrictions for admin access?

Best,
KS

 

[smarin]

Hi KS!
Two requests are send from different IP and have restrictions from console
Sorry for the inconvenience and thank you all for your help. I didn’t realize the console restriction.

Thanks and have a nice day!

 

[KyriacosS_3CX]

Hi,

No worries, as long as we know the root cause of the discrepancy, and it's a logical one, then hopefully this will be of help to others, so the community benefits!