Welcome to the Panopto Community

Please note: All new registrants to the Panopto Community Forum must be approved by a forum moderator or admin. As such, if you navigate to a feature that is members-only, you may receive an error page if your registration has not yet been approved. We apologize for any inconvenience and are approving new members as quickly as possible.

Is it possible to restrict API (SOAP/REST) access based on account permissions?

sakae uchiborisakae uchibori Tyro
in API

It might not be possible, but I’d like to ask anyway.

In the case of the Microsoft 365 MS Graph API, for example, you first register an application within the tenant.
Although it’s called an “application,” it doesn’t perform any actions on its own; rather, it serves to define the secrets and tokens needed when calling the Graph API from a script.

When registering an application,
・You can specify which areas the app can access (e.g., SharePoint Online only)
・You can specify what actions are permitted (Read-only / Read-Write)
・You can specify the scope of permissions (Full permissions, User)
and so on.
This prevents scripts from being able to do anything they want. Conversely, it also allows you to create scripts and tools that operate with standard user permissions. This is because, if you limit the scope to a user’s permissions, the script cannot access areas beyond what that user is authorized to access.

Is this kind of functionality possible with Panopto’s SOAP API or REST API? Based on the documentation, it appears that calls must be made after authenticating with an account that has global administrator permissions, so I suspect it might not be possible, but I’d like to confirm just in case.

Thank you.

Best Answers

  • Adis HrnjicaAdis Hrnjica Whiz Kid
    Answer ✓

    Hi Sakae,

    Panopto’s SOAP and REST APIs don’t need a global administrator account: every call runs as a specific Panopto user and gets exactly that user’s permissions, the same as in the web UI.

    For the REST API, you register an API client under System → API Clients and then authenticate as the user the script should act as, so the script can’t go beyond what that user is allowed to do. What Panopto doesn’t offer yet is Graph-style fine-grained scopes, so you can’t limit a client to a single area or to read-only access.

    The usual workaround is a dedicated service account that only has the access the script needs, for example Viewer access on certain folders, which makes the script effectively read-only and limited to those folders.

    I hope this helps.

    Thanks,

    -Adis

  • sakae uchiborisakae uchibori Tyro
    Answer ✓

    Adis,

    Thank you for your reply.

Sign In or Register to comment.