Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 19 Packages Projects Releases Wiki Activity

Update docs for API-only users (#45606)

Browse Source 
Resolves #42888
This commit is contained in:
Lucas Manuel Rodriguez
2026-05-15 15:14:19 -04:00
committed by GitHub
parent 5a0b17bac5
commit b3464452a1
2 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/fleetctl.md
+14 -7
View File
@@ -122,18 +122,25 @@ An API-only user does not have access to the Fleet UI. Instead, it's only purpos
#### Create API-only user
Before creating the API-only user, log in to fleetctl as an admin. See [authentication](#authentication) above for details.
To create an API-only user, navigate to **Settings > Users > Create user** and select the **API-only** option.
To create your new API-only user, use `fleetctl user create`:
You can optionally restrict the user to a specific list of API endpoints, which narrows access without expanding permissions beyond the user's role (for example, a team admin granted access to the [Update configuration](https://fleetdm.com/docs/rest-api/rest-api#update-configuration) endpoint will still receive a `403` response, because that endpoint is restricted to global admins).
You can also create an API-only user with `fleetctl`. First, log in to fleetctl as an admin (see [authentication](#authentication) above for details), then run:
```sh
fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only
fleetctl user create --name 'API User' --api-only
```
You'll then receive an API token:
`--email` and `--password` are optional when creating an API-only user. If omitted, Fleet generates an email derived from the creator's address; the user authenticates via API token only.
After running the command, you'll receive an API token:
```sh
Success! The API token for your new user is: <TOKEN>
Successfully created new user!
When you're ready to view the API token, press any key (will not be shown again):
The API token for your new user is: <TOKEN>
```
> If you need to retrieve this user's token again in the future, you can do so via the [log in API](https://fleetdm.com/docs/rest-api/rest-api#log-in).
@@ -143,13 +150,13 @@ Success! The API token for your new user is: <TOKEN>
An API-only user can be given the same permissions as a regular user. The default access level is **Observer**. You can specify what level of access the new user should have using the `--global-role` flag:
```sh
fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only --global-role 'admin'
fleetctl user create --name 'API User' --api-only --global-role 'admin'
```
On Fleet Premium, use the `--team <team_id>:<role>` to create an API-only user on a fleet:
```sh
fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only --team 4:gitops
fleetctl user create --name 'API User' --api-only --team 4:gitops
```
#### Changing permissions
articles/foreign-vitals-map-idp-users-to-hosts.md
+2 -3
View File
@@ -43,7 +43,6 @@ To map users from Okta to hosts in Fleet, we'll do the following steps:
5. For the **Authentication Mode**, select **HTTP Header**.
6. [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user. Paste your API token in Okta's **Authorization** field.
> For example, `fleetctl user create --name 'SCIM User' --email 'scim@example.com' --password 'hunter2' --api-only --global-role maintainer`
7. Select the **Test Connector Configuration** button. You should see a success message pop up in Okta. You can close this message.
8. In Fleet, head to **Settings > Integrations > Identity provider (IdP)** and verify that Fleet successfully received the request from Okta.
@@ -260,7 +259,7 @@ To map users from Google Workspace to hosts in Fleet, we'll do the following ste
1. From the side menu, select **Applications > Providers**, **Create**, **SCIM Provider**, and then **Next**.
2. Add a friendly name (e.g. "Fleet SCIM provider").
3. For the **URL**, enter `https://<your_fleet_server_url>/api/v1/fleet/scim`.
4. [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy the API token for that user. Paste your API token in the **Token** field.
4. [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user. Paste your API token in the **Secret token** field.
5. Select **Finish** to save provider.
6. Now, from the side menu, select **Applications > Applications**. Then, select **Create**.
7. Add a friendly name (e.g. "Fleet SCIM app") and slug (e.g. "fleet-scim-app").
@@ -273,7 +272,7 @@ To map users from Google Workspace to hosts in Fleet, we'll do the following ste
IdPs generally require a Fleet SCIM URL and API token:
- SCIM URL - `https://<your_fleet_server_url>/api/v1/fleet/scim`
- API token - [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user.
- API token - [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user. Paste your API token in the **Secret token** field.
Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Make sure these attributes are correctly mapped in your IdP with `userName` as the unique identifier. Fleet uses the `userName` attribute to map to IdP groups and department.