Permissions - Features permissions

Coherent plans to deprecate the features permissions functionality in the near future.

Although API keys can be used for machine-to-machine integrations, Client credentials are a more secure form of authorization. See Benefits of client credentials versus API keys.

Features permissions can be found in the Options menu under Features permissions.

Some Spark features can be executed independently from the Spark UI through APIs. These API endpoints have been grouped together by function and stored in feature permissions objects.

When using Authorization - API keys, access to the additional Spark API endpoints is managed through the features permissions objects. Features permissions allow the granular control of Authorization - API keys against different permissions to minimize the permissible access.

Use this to define API keys that have limited access to tenants and actions.

Prerequisites

• You must be a tenant-admin user.

• You must be a member of supervisor:pf to view all the features permissions.

Manage features permissions

Select the View icon to see the assigned user groups. There is a Description of the feature permission, the list of User groups that have access, and the Related API endpoints. API keys that contain the assigned user groups will be able to call the API endpoints listed while using their API key for authorization.

Add a user group to feature permissions

1. Identify the appropriate feature permission and the user group to give access.

2. Select the View icon for the feature permission.

3. Select the user group name from the dropdown box. For feature permissions other than Spark.AllEncompassingProxy.json, you cannot assign user:pf.

4. Select Add.

5. The user group is added right away.

Best practices

Minimize the permissible access

The optimal way to manage features permissions would be to create Authorization - API keys that each contain two or more user groups:

1. One or more User groups with access to the Spark services that should be actioned upon.

   • For example, if the Mexico team has full privileges to the multiple folders relating to Mexican insurance plans because they are members of the user:mexico, include user:mexico in the API key.

   • In a shared tenant, user:pf is the user group that provides universal access to services.

2. Additional User groups should be attributed to the permissible API key actions (feature permission). For example, to enable this key to use the POST /{tenant}/api/v3/folders/{folder}/services/{service}/download/xml/{callId} that gets a copy download services using the call_id,

   1. Select Options from the User menu.

   2. Select User groups.

   3. Select Add user group.

   4. Enter the User group name. In this example, name this user:download_call.

   5. You can enter a Description.

   6. No users need to be added to this user group.

   7. Select Submit.

   8. Make a new user group user:download_call. It does not need to have any users.

   9. Select Tenant configuration.

   10. Select Features permissions.

   11. Select the feature permission Spark.DownloadAPILog.json.

   12. From the dropdown, select the user group user:download_call.

   13. Select Add.

Once you have identified these two user groups, then create new Authorization - API keys that includes both user:mexico and user:download_call. In this manner, it is possible to limit the accessible Spark services and backend APIs.

Avoid using Spark.AllEncompassingProxy.json

• Any user groups that are assigned to this feature permission will have access to all the APIs. The user groups supervisor:pf or user:api_integration are automatically part of this group.

• In some cases, user:pf may also be assigned to this group. If you do not want keys containing user:pf to be able to also access all the listed backend APIs, then remove it from Spark.AllEncompassingProxy.json.

Manage and test permissions between environments

Customers should use similar setups for Authorization - API keys and Permissions - Features permissions in their testing and production environments to ensure that verification of the security in the testing environment aligns with the behaviors in production.