topic Re: Policies for Access Tokens? in Dynatrace API

Policies for Access Tokens

marina_pollehn — Mon, 16 Oct 2023 17:22:08 GMT

Hi all,

For a customer it would be ideal if I could get an access token with custom policies instead of the pre-set write settings.

I need a token with two very specific policies assigned to it. Edit alerting profiles and edit notifications. Is it possible to connect tokens and policies or select a custom scope of tokens? As far as I know, policies are specific to user accounts but maybe someone has an idea or I am missing something. 🙂 Help is greatly appreciated!

Re: Policies for Access Tokens?

radek_jasinski — Wed, 13 Sep 2023 10:05:33 GMT

Hi,

I don't remember there being an option to narrow down the permissions that much. What I would try is to create permissions (Manage monitoring settings)for a specific Management Zone. Then you would gain permissions to configure alert profiles, for example.

"Manage monitoring settings: Allows the changing of entity settings within a management zone, for example, the ability to record or edit synthetic monitors. It also grants access to some items in the global settings menu but only allows making modifications to assigned management zones. For example, alerting profiles can only be created and changed for a specific management zone."

For the API, you have to use the settings.read and settings.write scopes to make the changes you want:

https://www.dynatrace.com/support/help/dynatrace-api/environment-api/settings/schemas/builtin-alerting-profile

You can narrow down the scope by specifying additional parameters like the name of the MZ, etc....

Radek

Re: Policies for Access Tokens?

marina_pollehn — Wed, 13 Sep 2023 11:34:02 GMT

The problem is that these permissions are only usable for users, not tokens/API . 😞 the read and write API settings are way to broad for us.... Maybe something can be achieved with some scripting here.

Re: Policies for Access Tokens?

radek_jasinski — Wed, 13 Sep 2023 12:11:59 GMT

In my opinion, this is currently the only method. You can submit a product idea for Dynatrace to allow more complex permission management on the settings tab. 😊