Permission issue when using service account and HTTP API

Grafana Developers & API
1

Hi friends!

I’m having issues working with the HTTP API, using a service account token for authentication. Please note that other endpoints, such as /api/teams/search work just fine. See a description of my issue below. Any help would be greatly appreciated :slight_smile:

  • What Grafana version and what operating system are you using?
    Docker, image grafana/grafana-oss:9.3.1

  • What are you trying to achieve?
    I want to consume the HTTP API with a service account token. Specifically, I want to look up users using the /api/users/lookup endpoint

  • How are you trying to achieve it?

  1. Create a service account, give it Admin role
  2. Generate token
  3. Perform a get request to url http://api/users/lookup?loginOrEmail=<EMAIL_THAT_IM_LOOKING_FOR>, with header Authorization: Bearer <SERVICE_ACCOUNT_TOKEN>
  • What happened?
    I get the following error message:

{
“accessErrorId”: “ACE1715412157”,
“message”: “You’ll need additional permissions to perform this action. Permissions needed: users:read”,
“title”: “Access denied”
}

  • What did you expect to happen?
    Get a 2xx response with an array of 0 or more items in the body

  • Can you copy/paste the configuration(s) that you are having problems with?

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

  • Did you follow any online instructions? If so, what is the URL?

1 Like
2

I am facing the same issue. Any lead so far?
I updated the Grafana to 10.0.3 but still having the same error

Invoke-RestMethod: {“accessErrorId”:“ACE3712388049”,“message”:“You’ll need additional permissions to perform this action. Permissions needed: users:read”,“title”:“Access denied”}

3

I am experiencing the same issue. Does anyone have a solution or workaround?

4

Please share your code

5

sh-5.2$ curl -X GET -H “Accept: application/json” -H “Content-Type: application/json” -H "Authorization: token glsa_2ksETXCIN9xr6xZRTXAnfsIriNDkrElN_227b4783 " http://admin:admin@localhost:3000/api/users
{“accessErrorId”:“ACE3402518298”,“message”:“You’ll need additional permissions to perform this action. Permissions needed: users:read”,“title”:“Access denied”}

1 Like
6

yeah seems like it is still and issue

7

This is unfortunately just a bug in documentation which should be fixed now

see this issue HTTP API: search user by email using service account · Issue #72103 · grafana/grafana · GitHub

1 Like