Accessing /iarisk/v1/IPList/ALLOWED API results into API Access Error: UNPRIVILEGED_ACCESS_TOKEN

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Accessing the API /iarisk/v1/IPList/ALLOWED or /iarisk/v1/RiskRules results into error SecurityFilter: access denied - Invalid AT. API Access Error: UNPRIVILEGED_ACCESS_TOKEN.

The client application has "scope": "urn:iam:t.risk", but still throwing unprivileged access token error. Is there any other privilege required to make it work.

Environment

VIP Authentication Hub

Release : 3.1.1 and after

Cause

Risk API get get ALLOWED IP list or RiskRules are admin related operation and they required additional privileges to work.

Resolution

Grant the Configuration Administrator role to the client application.