github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-21 09:21:15 -05:00
Code Issues 856 Packages Projects Releases 74 Wiki Activity

[GH-ISSUE #787] 403 error on API key with full permissions #1632

New Issue
Closed
opened 2026-04-16 08:21:35 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-04-16 08:21:35 -05:00
Owner
Copy Link

Originally created by @kmanwar89 on GitHub (May 26, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/787

I'm trying to use the API for some programmatic/bulk adding of resources that all share a similar ruleset, without having to duplicate 2/3 dozen times. While reading through the Swagger docs, I'm trying to just do the simplest possible test - a GET to /orgs to get the Org ID, but each time I do it (through the Web UI or curl commands) I'm greeted with a 403: Key does not have root access error.

I created the API key with 100% wide open permissions, and am confident it has permissions to GET the orgs. I tried a different key with all permissions selected under the org; same issue.

I assumed it was Crowdsec banning my WAN IP (it was, for some reason), so I tried it again after removing all Crowdsec references from my compose file and traefik configs - no dice.

Any ideas on this one? I searched for others with the same issue, but their symptoms and resolutions were quite different.

Screenshot of error in the Swagger UI:

Image

And screenshot of API permissions:

Image
Originally created by @kmanwar89 on GitHub (May 26, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/787 I'm trying to use the API for some programmatic/bulk adding of resources that all share a similar ruleset, without having to duplicate 2/3 dozen times. While reading through the Swagger docs, I'm trying to just do the simplest possible test - a GET to /orgs to get the Org ID, but each time I do it (through the Web UI or `curl` commands) I'm greeted with a `403: Key does not have root access` error. I created the API key with 100% wide open permissions, and am confident it has permissions to GET the orgs. I tried a different key with all permissions selected under the org; same issue. I assumed it was Crowdsec banning my WAN IP (it was, for some reason), so I tried it again after removing all Crowdsec references from my compose file and traefik configs - no dice. Any ideas on this one? I searched for others with the same issue, but their symptoms and resolutions were quite different. Screenshot of error in the Swagger UI: ![Image](https://github.com/user-attachments/assets/7ee74c31-a42a-4655-b45b-32de3cba00c7) And screenshot of API permissions: <img width="1415" alt="Image" src="https://github.com/user-attachments/assets/82d338c9-11f8-438b-af80-7ed8f922a410" />
GiteaMirror commented 2026-04-16 08:21:36 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (May 27, 2025):

We need to work on better public documentation for the API, but some permissions are only scoped to root api keys. Looks like from the screenshot this is an "org" API key not a root key. An org key is generated from the sidebar in an organization while the root key is generated from the server admin panel. Let me know if there are still issues and might be a bug.

<!-- gh-comment-id:2910977353 --> @miloschwartz commented on GitHub (May 27, 2025): We need to work on better public documentation for the API, but some permissions are only scoped to root api keys. Looks like from the screenshot this is an "org" API key not a root key. An org key is generated from the sidebar in an organization while the root key is generated from the server admin panel. Let me know if there are still issues and might be a bug.
GiteaMirror commented 2026-04-16 08:21:37 -05:00
Author
Owner
Copy Link

@manelmolinaig commented on GitHub (May 27, 2025):

We need to work on better public documentation for the API, but some permissions are only scoped to root api keys. Looks like from the screenshot this is an "org" API key not a root key. An org key is generated from the sidebar in an organization while the root key is generated from the server admin panel. Let me know if there are still issues and might be a bug.

Related to API documentation... https://docs.fossorial.io/Pangolin/API/integration-api

Seems that is necessary to add routers to reach the API on api.domain.com, but my traefik config file (v4) already have API routers on domain.com/api Which is the right endpoint/subdomain?

Thanks!

<!-- gh-comment-id:2911755458 --> @manelmolinaig commented on GitHub (May 27, 2025): > We need to work on better public documentation for the API, but some permissions are only scoped to root api keys. Looks like from the screenshot this is an "org" API key not a root key. An org key is generated from the sidebar in an organization while the root key is generated from the server admin panel. Let me know if there are still issues and might be a bug. Related to API documentation... https://docs.fossorial.io/Pangolin/API/integration-api Seems that is necessary to add routers to reach the API on api.domain.com, but my traefik config file (v4) already have API routers on domain.com/api Which is the right endpoint/subdomain? Thanks!
GiteaMirror commented 2026-04-16 08:21:37 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (May 27, 2025):

The integration API is separate from the internal API (at /api/v1) used by the Pangolin web UI. This was to make it easier to keep stable and authenticate differently.

It is best to expose this with the example traefik config I think.

<!-- gh-comment-id:2912699286 --> @oschwartz10612 commented on GitHub (May 27, 2025): The integration API is separate from the internal API (at /api/v1) used by the Pangolin web UI. This was to make it easier to keep stable and authenticate differently. It is best to expose this with the example traefik config I think.
GiteaMirror commented 2026-04-16 08:21:38 -05:00
Author
Owner
Copy Link

@kmanwar89 commented on GitHub (May 28, 2025):

Thank you! I totally glanced over that in the documentation and didn't realize the different scope was per-org (which is much more secure, and I'm glad to see that's already a feature!). I can confirm creating the API key via the Server Admin fixed my issue and I was able to list the orgs and can now begin developing my automated flows. Thank you again @miloschwartz

I'll let you decide if this should be closed or not, but its solved from my perspective

<!-- gh-comment-id:2917449678 --> @kmanwar89 commented on GitHub (May 28, 2025): Thank you! I totally glanced over that in the documentation and didn't realize the different scope was per-org (which is much more secure, and I'm glad to see that's already a feature!). I can confirm creating the API key via the Server Admin fixed my issue and I was able to list the orgs and can now begin developing my automated flows. Thank you again @miloschwartz I'll let you decide if this should be closed or not, but its solved from my perspective
GiteaMirror commented 2026-04-16 08:21:38 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (May 29, 2025):

Happy it is working! I will close but feel free to reopen.

<!-- gh-comment-id:2919627964 --> @oschwartz10612 commented on GitHub (May 29, 2025): Happy it is working! I will close but feel free to reopen.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#1632
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?