fleet/changes/api-endpoints-add-reports-run at 2fd2a02e2d71b65e19bd06f97d14186866f514b7 - fleet - Gitea: Git with a cup of tea

Discharge7443/fleet

Files

T

Nico 7dfcb76a02 Add POST /reports/run to the API endpoints catalog (#48790 )

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Relates to #43544

The Fleet MCP server runs multi-host live queries by creating an ad-hoc
campaign via `POST /api/v1/fleet/reports/run`, but that route is missing
from the API endpoints catalog. An api-only user restricted to a
specific endpoint allowlist therefore cannot be granted it and receives
a 403, so multi-host live queries fail under a least-privilege setup.
This adds the route to the catalog so it can be granted; it stays gated
by observer_plus RBAC and does not match any allowlist-bypass blocklist
rule.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added support for an asynchronous live report run endpoint.
* API-only users on restricted allowlists can now be granted access to
run reports.
* **Changes**
* Updated the live report endpoint path and display name to reflect the
async behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-07-07 09:59:12 -03:00

2 lines

195 B

Plaintext

Raw Blame History

- Added the asynchronous live query endpoint (`POST /api/v1/fleet/reports/run`) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.