XAPI for managing multi-tenant

[bengrabau]

I'm working on a tool to automatically provision a new tenant in multi-company/multi-tenant mode.

I've created my service principals as System Owner on the DEFAULT group and it's successfully authenticating, but when I try to retrieve the departments (/xapi/v1/Groups) list I get a "403 Forbidden" error.

I'm pretty confident it's related to trying to access the departments using the service principal because I'm able to retrieve them when:

1. I connect to a PBX without multi-company mode enabled.
2. If I grab the bearer token from my web browser for the MT system logged in as a System Owner it works fine.

Am I creating my service principal incorrectly, accessing it incorrectly or is it a limitation of the XAPI on multi-tenant. And if the latter, why?

 

[fxbastler]

Post in thread 'V20 Windows App provisioning'

Oct 1, 2025

To clarify:
Basically anything that can be configured in the 3CX Web Management Console can also be automated - and a little bit more.

The 3CX Management Console does nothing more than send API calls to 3CX from the browser. You can see this in action, see above.

• fxbastler

 

[bengrabau]

I understand the web interface uses the same API calls as the service principals, however there seems to be a discrepancy in the rights assigned to a system owner service principal vs a system owner user account.

I used the browser dev tools to copy the API calls to PowerShell and tried the same calls with both my user account bearer token and the service principal.

 

[ChrisC_3CX]

Hey @bengrabau

I can verify this should work with a service principal with system owner role and by first obtaining a token with: /connect/token

Make sure you've set up the service principal as seen below (ClientID of your choice):


If you still can't figure out what's happening you could enable Verbose logging and take a look at the Management Console log hopefully it sheds some light on the matter.

 

[bengrabau]

I spun up another multi-tenant system and it is working fine. It seems it might be my original installation that has the problem. I logged a ticket with 3CX but it was closed as they can't provide support for the API. Might just have to re-install.

 

[bengall]

Check your console IP restriction, especially when using Postman!
This caused me a couple of hours of frustration...
I also had to update the permissions against the Department to System Owner.