Policies for Access Tokens

[marina_pollehn]

Hi all,

For a customer it would be ideal if I could get an access token with custom policies instead of the pre-set write settings.

I need a token with two very specific policies assigned to it. Edit alerting profiles and edit notifications. Is it possible to connect tokens and policies or select a custom scope of tokens? As far as I know, policies are specific to user accounts but maybe someone has an idea or I am missing something. 🙂 Help is greatly appreciated!

[radek_jasinski]

Hi,

I don't remember there being an option to narrow down the permissions that much. What I would try is to create permissions (Manage monitoring settings)for a specific Management Zone. Then you would gain permissions to configure alert profiles, for example.

"Manage monitoring settings: Allows the changing of entity settings within a management zone, for example, the ability to record or edit synthetic monitors. It also grants access to some items in the global settings menu but only allows making modifications to assigned management zones. For example, alerting profiles can only be created and changed for a specific management zone."

For the API, you have to use the settings.read and settings.write scopes to make the changes you want:

https://www.dynatrace.com/support/help/dynatrace-api/environment-api/settings/schemas/builtin-alerti...

You can narrow down the scope by specifying additional parameters like the name of the MZ, etc....

Radek

[marina_pollehn]

The problem is that these permissions are only usable for users, not tokens/API . 😞 the read and write API settings are way to broad for us.... Maybe something can be achieved with some scripting here.

[radek_jasinski]

In my opinion, this is currently the only method. You can submit a product idea for Dynatrace to allow more complex permission management on the settings tab. 😊