PAM User Can See Target Accounts in the GUI, But Cannot List Device in API

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When a user access the PAM GUI, they can see all target accounts they need. But when they try to use the API to list the devices associated with the target accounts, which is part of their script, one or more of the devices were missing.

Environment

Privileged Access Manager 3.4.x, 4.0.x

Cause

When looking at the CM Target Group, all devices are listed. However, one device was not in the device group the user was configured to access.

For example, the user could list all target accounts from the following three devices.

But when listing them in the API, only two of the three devices are listed.

Resolution

Update the missing devices to ensure the user has proper access to them, then they will be listed in the API output.