| 1 | # Netdata API Permissions and Access Control Analysis |
| 2 | |
| 3 | **Generated:** 2025-10-02 |
| 4 | **Purpose:** Document ACL and HTTP_ACCESS requirements for all 68 Netdata APIs |
| 5 | |
| 6 | ## Permission System Overview |
| 7 | |
| 8 | ### HTTP_ACL (Access Control List) |
| 9 | Controls **HOW** the API can be accessed (transport/source): |
| 10 | |
| 11 | - `HTTP_ACL_NOCHECK` - No ACL checking (always allow based on other criteria) |
| 12 | - `HTTP_ACL_API` - Via HTTP/HTTPS web server (TCP port 19999) |
| 13 | - `HTTP_ACL_ACLK` - **Via ACLK only** (Netdata Cloud connection) |
| 14 | - `HTTP_ACL_WEBRTC` - Via WebRTC connection |
| 15 | - `HTTP_ACL_METRICS` - Metrics data access category |
| 16 | - `HTTP_ACL_FUNCTIONS` - Functions execution category |
| 17 | - `HTTP_ACL_NODES` - Node information category |
| 18 | - `HTTP_ACL_ALERTS` - Alerts access category |
| 19 | - `HTTP_ACL_DYNCFG` - Dynamic configuration category |
| 20 | - `HTTP_ACL_REGISTRY` - Registry access category |
| 21 | - `HTTP_ACL_BADGES` - Badges generation category |
| 22 | - `HTTP_ACL_MANAGEMENT` - Management operations category |
| 23 | - `HTTP_ACL_STREAMING` - Streaming category |
| 24 | - `HTTP_ACL_NETDATACONF` - Netdata configuration category |
| 25 | |
| 26 | ### HTTP_ACCESS (Permission Flags) |
| 27 | Controls **WHAT** the authenticated user can do (capabilities): |
| 28 | |
| 29 | - `HTTP_ACCESS_NONE` - No specific access required (public) |
| 30 | - `HTTP_ACCESS_SIGNED_ID` - User must be authenticated |
| 31 | - `HTTP_ACCESS_SAME_SPACE` - User and agent must be in same Netdata Cloud space |
| 32 | - `HTTP_ACCESS_COMMERCIAL_SPACE` - Requires commercial plan |
| 33 | - `HTTP_ACCESS_ANONYMOUS_DATA` - Can view basic metrics/data |
| 34 | - `HTTP_ACCESS_SENSITIVE_DATA` - Can view sensitive information |
| 35 | - `HTTP_ACCESS_VIEW_AGENT_CONFIG` - Can read agent configuration |
| 36 | - `HTTP_ACCESS_EDIT_AGENT_CONFIG` - Can modify agent configuration |
| 37 | - `HTTP_ACCESS_VIEW_NOTIFICATIONS_CONFIG` - Can read notifications config |
| 38 | - `HTTP_ACCESS_EDIT_NOTIFICATIONS_CONFIG` - Can modify notifications config |
| 39 | - `HTTP_ACCESS_VIEW_ALERTS_SILENCING` - Can read silencing rules |
| 40 | - `HTTP_ACCESS_EDIT_ALERTS_SILENCING` - Can modify silencing rules |
| 41 | |
| 42 | ### HTTP_USER_ROLE |
| 43 | User roles with hierarchical permissions (lower number = more permissions): |
| 44 | |
| 45 | 1. `HTTP_USER_ROLE_ADMIN` - Full administrative access |
| 46 | 2. `HTTP_USER_ROLE_MANAGER` - Management access |
| 47 | 3. `HTTP_USER_ROLE_TROUBLESHOOTER` - Diagnostic access |
| 48 | 4. `HTTP_USER_ROLE_OBSERVER` - Read-only access |
| 49 | 5. `HTTP_USER_ROLE_MEMBER` - Basic member access |
| 50 | 6. `HTTP_USER_ROLE_BILLING` - Billing-related access |
| 51 | 7. `HTTP_USER_ROLE_ANY` - Any authenticated user |
| 52 | |
| 53 | --- |
| 54 | |
| 55 | ## V3 APIs (27 total) - CURRENT/LATEST |
| 56 | |
| 57 | ### Public Data APIs (Accessible by anyone, local or cloud) |
| 58 | These require only `HTTP_ACCESS_ANONYMOUS_DATA` - available to all users including unauthenticated: |
| 59 | |
| 60 | | API | ACL | Access | Description | |
| 61 | |-----|-----|--------|-------------| |
| 62 | | `/api/v3/data` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | Time-series data query | |
| 63 | | `/api/v3/badge.svg` | `HTTP_ACL_BADGES` | `ANONYMOUS_DATA` | Badge generation | |
| 64 | | `/api/v3/weights` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | Scoring engine | |
| 65 | | `/api/v3/allmetrics` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | Metrics export | |
| 66 | | `/api/v3/context` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | Context metadata | |
| 67 | | `/api/v3/contexts` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | Multi-node contexts | |
| 68 | | `/api/v3/q` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | Full-text search | |
| 69 | | `/api/v3/alerts` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | Multi-node alerts | |
| 70 | | `/api/v3/alert_transitions` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | Alert history | |
| 71 | | `/api/v3/alert_config` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | Alert configuration | |
| 72 | | `/api/v3/variable` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | Chart variables | |
| 73 | | `/api/v3/nodes` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | Nodes listing | |
| 74 | | `/api/v3/node_instances` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | Node instances | |
| 75 | | `/api/v3/stream_path` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | Streaming topology | |
| 76 | | `/api/v3/function` | `HTTP_ACL_FUNCTIONS` | `ANONYMOUS_DATA` | Execute function (permissions checked per-function) | |
| 77 | | `/api/v3/functions` | `HTTP_ACL_FUNCTIONS` | `ANONYMOUS_DATA` | List functions | |
| 78 | | `/api/v3/config` | `HTTP_ACL_DYNCFG` | `ANONYMOUS_DATA` | Dynamic configuration (read/write permissions checked per-action) | |
| 79 | |
| 80 | ### Public Info APIs (No authentication required) |
| 81 | These have `HTTP_ACL_NOCHECK` and `HTTP_ACCESS_NONE`: |
| 82 | |
| 83 | | API | ACL | Access | Description | |
| 84 | |-----|-----|--------|-------------| |
| 85 | | `/api/v3/info` | `HTTP_ACL_NOCHECK` | `NONE` | Agent information | |
| 86 | | `/api/v3/versions` | `HTTP_ACL_NOCHECK` | `ANONYMOUS_DATA` | Version information | |
| 87 | | `/api/v3/progress` | `HTTP_ACL_NOCHECK` | `ANONYMOUS_DATA` | Function progress tracking | |
| 88 | | `/api/v3/settings` | `HTTP_ACL_NOCHECK` | `ANONYMOUS_DATA` | User settings (GET/PUT) | |
| 89 | | `/api/v3/stream_info` | `HTTP_ACL_NOCHECK` | `NONE` | Streaming statistics | |
| 90 | | `/api/v3/claim` | `HTTP_ACL_NOCHECK` | `NONE` | Agent claiming (security key required) | |
| 91 | | `/api/v3/me` | `HTTP_ACL_NOCHECK` | `NONE` | Current user info | |
| 92 | |
| 93 | ### ACLK-Only APIs (Netdata Cloud Access Required) |
| 94 | These require `HTTP_ACL_ACLK` - **ONLY accessible via Netdata Cloud (ACLK)**: |
| 95 | |
| 96 | | API | ACL | Access | Requirements | Description | |
| 97 | |-----|-----|--------|--------------|-------------| |
| 98 | | `/api/v3/rtc_offer` | `HTTP_ACL_ACLK` | `SIGNED_ID` + `SAME_SPACE` | Authenticated user in same space | WebRTC connection establishment | |
| 99 | | `/api/v3/bearer_protection` | `HTTP_ACL_ACLK` | `SIGNED_ID` + `SAME_SPACE` + `VIEW_AGENT_CONFIG` + `EDIT_AGENT_CONFIG` | Admin/Manager role | Enable/disable bearer protection | |
| 100 | | `/api/v3/bearer_get_token` | `HTTP_ACL_ACLK` | `SIGNED_ID` + `SAME_SPACE` | Authenticated user in same space | Generate bearer token | |
| 101 | |
| 102 | **Note:** `ACL_DEV_OPEN_ACCESS` flag makes these available in dev mode without ACLK restriction. |
| 103 | |
| 104 | --- |
| 105 | |
| 106 | ## V2 APIs (17 total) - DEPRECATED |
| 107 | |
| 108 | All V2 APIs have same ACL/access as their V3 equivalents: |
| 109 | |
| 110 | ### Public Data APIs |
| 111 | | API | ACL | Access | |
| 112 | |-----|-----|--------| |
| 113 | | `/api/v2/data` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 114 | | `/api/v2/weights` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 115 | | `/api/v2/contexts` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 116 | | `/api/v2/q` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 117 | | `/api/v2/alerts` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 118 | | `/api/v2/alert_transitions` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 119 | | `/api/v2/alert_config` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 120 | | `/api/v2/nodes` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 121 | | `/api/v2/node_instances` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 122 | | `/api/v2/versions` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 123 | | `/api/v2/functions` | `HTTP_ACL_FUNCTIONS` | `ANONYMOUS_DATA` | |
| 124 | |
| 125 | ### Public Info APIs |
| 126 | | API | ACL | Access | |
| 127 | |-----|-----|--------| |
| 128 | | `/api/v2/info` | `HTTP_ACL_NOCHECK` | `ANONYMOUS_DATA` | |
| 129 | | `/api/v2/progress` | `HTTP_ACL_NOCHECK` | `ANONYMOUS_DATA` | |
| 130 | | `/api/v2/claim` | `HTTP_ACL_NOCHECK` | `NONE` | |
| 131 | |
| 132 | ### ACLK-Only APIs |
| 133 | | API | ACL | Access | |
| 134 | |-----|-----|--------| |
| 135 | | `/api/v2/rtc_offer` | `HTTP_ACL_ACLK` | `SIGNED_ID` + `SAME_SPACE` | |
| 136 | | `/api/v2/bearer_protection` | `HTTP_ACL_ACLK` | `SIGNED_ID` + `SAME_SPACE` + `VIEW_AGENT_CONFIG` + `EDIT_AGENT_CONFIG` | |
| 137 | | `/api/v2/bearer_get_token` | `HTTP_ACL_ACLK` | `SIGNED_ID` + `SAME_SPACE` | |
| 138 | |
| 139 | --- |
| 140 | |
| 141 | ## V1 APIs (24 total) - DEPRECATED |
| 142 | |
| 143 | ### Public Data APIs |
| 144 | | API | ACL | Access | |
| 145 | |-----|-----|--------| |
| 146 | | `/api/v1/data` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 147 | | `/api/v1/weights` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 148 | | `/api/v1/metric_correlations` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 149 | | `/api/v1/badge.svg` | `HTTP_ACL_BADGES` | `ANONYMOUS_DATA` | |
| 150 | | `/api/v1/allmetrics` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 151 | | `/api/v1/chart` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 152 | | `/api/v1/charts` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 153 | | `/api/v1/context` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 154 | | `/api/v1/contexts` | `HTTP_ACL_METRICS` | `ANONYMOUS_DATA` | |
| 155 | | `/api/v1/function` | `HTTP_ACL_FUNCTIONS` | `ANONYMOUS_DATA` | |
| 156 | | `/api/v1/functions` | `HTTP_ACL_FUNCTIONS` | `ANONYMOUS_DATA` | |
| 157 | | `/api/v1/config` | `HTTP_ACL_DYNCFG` | `ANONYMOUS_DATA` | |
| 158 | |
| 159 | ### Alert APIs |
| 160 | | API | ACL | Access | |
| 161 | |-----|-----|--------| |
| 162 | | `/api/v1/alarms` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 163 | | `/api/v1/alarms_values` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 164 | | `/api/v1/alarm_log` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 165 | | `/api/v1/alarm_variables` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 166 | | `/api/v1/variable` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 167 | | `/api/v1/alarm_count` | `HTTP_ACL_ALERTS` | `ANONYMOUS_DATA` | |
| 168 | |
| 169 | ### Node Info APIs |
| 170 | | API | ACL | Access | |
| 171 | |-----|-----|--------| |
| 172 | | `/api/v1/info` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 173 | | `/api/v1/aclk` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 174 | | `/api/v1/dbengine_stats` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 175 | | `/api/v1/ml_info` | `HTTP_ACL_NODES` | `ANONYMOUS_DATA` | |
| 176 | |
| 177 | ### Special APIs |
| 178 | | API | ACL | Access | Notes | |
| 179 | |-----|-----|--------|-------| |
| 180 | | `/api/v1/registry` | `HTTP_ACL_NONE` | `NONE` | Manages ACL internally | |
| 181 | | `/api/v1/manage` | `HTTP_ACL_MANAGEMENT` | `NONE` | Manages access internally, requires `HTTP_ACL_MANAGEMENT` | |
| 182 | |
| 183 | --- |
| 184 | |
| 185 | ## Security Summary by Category |
| 186 | |
| 187 | ### 1. ACLK-Only APIs (Cloud Access Required) |
| 188 | **Count:** 6 APIs (3 v3, 3 v2) |
| 189 | |
| 190 | These APIs are ONLY accessible through Netdata Cloud (ACLK connection): |
| 191 | - `rtc_offer` - WebRTC setup (**Experimental feature, not compiled by default**) |
| 192 | - `bearer_protection` - Requires admin/manager permissions |
| 193 | - `bearer_get_token` - Generate authentication tokens |
| 194 | |
| 195 | **Access Requirement:** User must be authenticated (`SIGNED_ID`) and in the same Netdata Cloud space as the agent (`SAME_SPACE`) |
| 196 | |
| 197 | **Cannot be accessed via:** Direct HTTP/HTTPS to agent (even with bearer token) |
| 198 | |
| 199 | **Note:** WebRTC (`rtc_offer`) is an experimental feature and is not compiled by default. It requires special build configuration. |
| 200 | |
| 201 | ### 2. Optionally Protected Data APIs (Bearer Protection Configurable) |
| 202 | **Count:** 47 APIs across all versions |
| 203 | |
| 204 | These provide read access to metrics, alerts, and metadata with `HTTP_ACCESS_ANONYMOUS_DATA`. |
| 205 | |
| 206 | **Default Mode (Public):** |
| 207 | - No authentication required |
| 208 | - Available to local dashboard, cloud users, external tools |
| 209 | - Subject to IP-based ACL restrictions in netdata.conf |
| 210 | |
| 211 | **Bearer Protection Mode (when enabled):** |
| 212 | - Requires valid bearer token for access |
| 213 | - Bearer tokens obtained via `/api/v*/bearer_get_token` (ACLK-only) |
| 214 | - Still subject to IP-based ACL restrictions |
| 215 | - Provides token-based authentication layer |
| 216 | |
| 217 | **Configuration:** Set bearer protection via `/api/v*/bearer_protection` API or netdata.conf |
| 218 | |
| 219 | ### 3. Configuration APIs (Permissions Checked Per-Action) |
| 220 | **Count:** 3 APIs |
| 221 | |
| 222 | - `/api/v*/config` - Read operations allowed for all, write operations check permissions internally |
| 223 | - `/api/v*/function` - Execution permissions checked per-function by plugins |
| 224 | - `/api/v1/manage` - Manages permissions internally |
| 225 | |
| 226 | **Note:** These respect bearer protection if enabled (they have `HTTP_ACCESS_ANONYMOUS_DATA`) |
| 227 | |
| 228 | ### 4. Always Public APIs (Cannot Be Restricted) |
| 229 | **Count:** 12 APIs |
| 230 | |
| 231 | These have `HTTP_ACL_NOCHECK` meaning they bypass ALL security: |
| 232 | - Agent info |
| 233 | - Version info |
| 234 | - Progress tracking |
| 235 | - Current user info |
| 236 | - Settings (user preferences) |
| 237 | - Claiming (protected by security key mechanism, not ACL/bearer) |
| 238 | |
| 239 | **Important:** These are ALWAYS accessible: |
| 240 | - NOT affected by bearer protection |
| 241 | - NOT subject to IP-based ACL |
| 242 | - Cannot be restricted by any configuration |
| 243 | |
| 244 | **Important:** These APIs are ALWAYS public and cannot be restricted: |
| 245 | - NOT subject to IP-based ACL restrictions |
| 246 | - NOT subject to bearer protection |
| 247 | - Always accessible without authentication |
| 248 | |
| 249 | --- |
| 250 | |
| 251 | ## Permission Checking Flow |
| 252 | |
| 253 | 1. **ACL Check** (web_api.c:65-67) |
| 254 | ```c |
| 255 | bool acl_allows = ((w->acl & api_commands[i].acl) == api_commands[i].acl) |
| 256 | || (api_commands[i].acl & HTTP_ACL_NOCHECK); |
| 257 | ``` |
| 258 | - Verifies request came through allowed transport (API, ACLK, WebRTC) |
| 259 | - Verifies request matches allowed feature category |
| 260 | |
| 261 | 2. **Access Check** (web_api.c:69-72) |
| 262 | ```c |
| 263 | bool permissions_allows = |
| 264 | http_access_user_has_enough_access_level_for_endpoint( |
| 265 | w->user_auth.access, api_commands[i].access); |
| 266 | ``` |
| 267 | - Verifies user has required permission flags |
| 268 | - Checks user role has sufficient access level |
| 269 | |
| 270 | 3. **Internal Permission Checks** |
| 271 | - Some APIs (config, function, registry, manage) perform additional permission validation within their implementation |
| 272 | - These check specific actions or function-level permissions |
| 273 | |
| 274 | --- |
| 275 | |
| 276 | ## Configuration Impact |
| 277 | |
| 278 | ### netdata.conf ACL Settings |
| 279 | IP-based ACL restrictions can be applied to feature categories: |
| 280 | |
| 281 | ```conf |
| 282 | [web] |
| 283 | allow connections from = localhost * |
| 284 | allow dashboard from = * |
| 285 | allow badges from = * |
| 286 | allow streaming from = * |
| 287 | allow netdata.conf from = localhost fd* 10.* 192.168.* 172.16.* 172.17.* 172.18.* 172.19.* 172.20.* 172.21.* 172.22.* 172.23.* 172.24.* 172.25.* 172.26.* 172.27.* 172.28.* 172.29.* 172.30.* 172.31.* UNKNOWN |
| 288 | allow management from = localhost |
| 289 | ``` |
| 290 | |
| 291 | These settings affect which IP addresses can access APIs in each category. |
| 292 | |
| 293 | ### Bearer Protection |
| 294 | When enabled via `bearer_protection` API or netdata.conf, APIs with `HTTP_ACCESS_ANONYMOUS_DATA` require bearer token authentication. |
| 295 | |
| 296 | **Effect:** |
| 297 | - Changes security model from public/IP-based to token-based |
| 298 | - Only affects APIs with `HTTP_ACCESS_ANONYMOUS_DATA` (47 APIs) |
| 299 | - Does NOT affect `HTTP_ACL_NOCHECK` APIs (always public) |
| 300 | - Does NOT affect ACLK-only APIs (already require cloud authentication) |
| 301 | |
| 302 | **Token Management:** |
| 303 | - Tokens obtained via `/api/v*/bearer_get_token` (requires ACLK access) |
| 304 | - Tokens are time-limited with expiration |
| 305 | - Tokens include role-based access control (admin, manager, etc.) |
| 306 | |
| 307 | **Use Cases:** |
| 308 | - Securing public-facing Netdata agents |
| 309 | - Controlling access to metrics/alerts APIs |
| 310 | - Integrating with external authentication systems |
| 311 | |
| 312 | --- |
| 313 | |
| 314 | ## Recommendations for Swagger Documentation |
| 315 | |
| 316 | Each API should document: |
| 317 | |
| 318 | ### 1. **Access Type (Primary Classification):** |
| 319 | |
| 320 | **For ACLK-Only APIs:** |
| 321 | ``` |
| 322 | ⚠️ **ACLK-Only API - Cloud Access Required** |
| 323 | |
| 324 | This API is ONLY accessible via Netdata Cloud (ACLK). Direct HTTP/HTTPS access to the agent is not allowed. |
| 325 | |
| 326 | **Requirements:** |
| 327 | - User must be authenticated via Netdata Cloud |
| 328 | - User and agent must be in the same Netdata Cloud space |
| 329 | - [Additional role requirements if applicable] |
| 330 | ``` |
| 331 | |
| 332 | **For HTTP_ACCESS_ANONYMOUS_DATA APIs:** |
| 333 | ``` |
| 334 | 📊 **Public Data API (Bearer Protection Configurable)** |
| 335 | |
| 336 | **Default Mode:** Publicly accessible without authentication |
| 337 | **Bearer Protection Mode:** Requires valid bearer token when enabled |
| 338 | |
| 339 | **Access Methods:** |
| 340 | - Direct HTTP/HTTPS to agent (default: public, configurable) |
| 341 | - Netdata Cloud (authenticated) |
| 342 | - External tools/integrations |
| 343 | |
| 344 | **IP Restrictions:** Subject to [ACL category] restrictions in netdata.conf |
| 345 | **Bearer Protection:** Can be enabled via netdata.conf or `/api/v3/bearer_protection` |
| 346 | ``` |
| 347 | |
| 348 | **For HTTP_ACL_NOCHECK APIs:** |
| 349 | ``` |
| 350 | 🔓 **Always Public API** |
| 351 | |
| 352 | This API is always publicly accessible and cannot be restricted. |
| 353 | |
| 354 | **No Security:** |
| 355 | - Not subject to bearer protection |
| 356 | - Not subject to IP-based ACL restrictions |
| 357 | - No authentication required or possible |
| 358 | ``` |
| 359 | |
| 360 | ### 2. **ACL Category:** |
| 361 | Document which ACL category applies (for IP restriction): |
| 362 | - `HTTP_ACL_METRICS` → "allow dashboard from" in netdata.conf |
| 363 | - `HTTP_ACL_ALERTS` → "allow dashboard from" in netdata.conf |
| 364 | - `HTTP_ACL_NODES` → "allow dashboard from" in netdata.conf |
| 365 | - `HTTP_ACL_FUNCTIONS` → "allow dashboard from" in netdata.conf |
| 366 | - `HTTP_ACL_DYNCFG` → "allow dashboard from" in netdata.conf |
| 367 | - `HTTP_ACL_BADGES` → "allow badges from" in netdata.conf |
| 368 | - `HTTP_ACL_MANAGEMENT` → "allow management from" in netdata.conf |
| 369 | |
| 370 | ### 3. **Permission Details:** |
| 371 | - List required HTTP_ACCESS flags when applicable |
| 372 | - Note minimum user role for ACLK-only APIs |
| 373 | - Explain any per-action or per-function permission checks |
| 374 | |
| 375 | ### 4. **Bearer Protection Impact:** |
| 376 | ``` |
| 377 | **When Bearer Protection is Enabled:** |
| 378 | - Requires valid bearer token in Authorization header |
| 379 | - Token format: `Authorization: Bearer <token>` |
| 380 | - Tokens obtained via `/api/v3/bearer_get_token` (ACLK-only) |
| 381 | - Token expiration and renewal required |
| 382 | ``` |
| 383 | |
| 384 | --- |
| 385 | |
| 386 | **Last Updated:** 2025-10-02 |
| 387 | **Next Action:** Add security documentation to all 68 APIs in swagger.yaml |