Permission issue when using service account and HTTP API

Grafana Developers & API
1

Hi friends!

I’m having issues working with the HTTP API, using a service account token for authentication. Please note that other endpoints, such as /api/teams/search work just fine. See a description of my issue below. Any help would be greatly appreciated :slight_smile:

  • What Grafana version and what operating system are you using?
    Docker, image grafana/grafana-oss:9.3.1

  • What are you trying to achieve?
    I want to consume the HTTP API with a service account token. Specifically, I want to look up users using the /api/users/lookup endpoint

  • How are you trying to achieve it?

  1. Create a service account, give it Admin role
  2. Generate token
  3. Perform a get request to url http://api/users/lookup?loginOrEmail=<EMAIL_THAT_IM_LOOKING_FOR>, with header Authorization: Bearer <SERVICE_ACCOUNT_TOKEN>
  • What happened?
    I get the following error message:

{
“accessErrorId”: “ACE1715412157”,
“message”: “You’ll need additional permissions to perform this action. Permissions needed: users:read”,
“title”: “Access denied”
}

  • What did you expect to happen?
    Get a 2xx response with an array of 0 or more items in the body

  • Can you copy/paste the configuration(s) that you are having problems with?

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

  • Did you follow any online instructions? If so, what is the URL?

1 Like