Minimum Administrative Roles for Health Monitoring AuthToken API

Products

• CA Strong Authentication
• CA Advanced Authentication
• CA Advanced Authentication - Risk Authentication (RiskMinder / RiskFort)
• CA Advanced Authentication - Strong Authentication (AuthMinder / WebFort)
• CA Risk Authentication

Issue/Introduction

When attempting to invoke the Advanced Authentication REST API for Health Monitoring (/arcotadmin/MonitorHealth/authtoken), users may encounter authorization errors or failures if the administrative user does not possess the appropriate role permissions.

Environment

Symantec Advanced Authentication 9.1.5.x

Cause

The Health Monitoring AuthToken API is restricted to specific administrative tiers. Not all roles within the Advanced Authentication framework are authorized to generate the security tokens required to access health data.

Resolution

Authentication token generation for securing Health Monitoring APIs is supported for the following administrative roles only. To successfully invoke the /arcotadmin/MonitorHealth/authtoken endpoint, ensure the admin user is assigned one of the following:

• MasterAdmin

• GlobalAdmin

• OrgAdmin

• UserAdmin

Unsupported Roles

The following roles do not have the necessary permissions to generate an authentication token via this API:

• Queue Manager

• CSR (Customer Service Representative)

Implementation Notes

We recommend utilizing the /arcotadmin/MonitorHealth/authtoken API as the primary method for securing REST-based health monitoring implementations. This ensures that only authorized administrators can retrieve sensitive system health metrics.

Additional Information

For detailed request and response syntax, please refer to the Health Monitoring AuthToken API section in the official product documentation.