# Can I restrict API access?

**URL:** <https://forum.mautic.org/t/can-i-restrict-api-access/29630>\
**Category:** Product Support\
**Created:** [October 12, 2023, 12:33pm UTC](https://forum.mautic.org/t/can-i-restrict-api-access/29630 "2023-10-12T12:33:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gwentara](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/gwentara/32/14260_2.png) [@gwentara](https://forum.mautic.org/u/gwentara)\
**Post date:** [October 12, 2023, 12:33pm UTC](https://forum.mautic.org/t/can-i-restrict-api-access/29630/1 "2023-10-12T12:33:13Z")

</div>

My Mautic version is: v4.4.9

Hello,

I have a general question: when I create an API key, is there a way to restict the rights for that key, so that only certain requests are allowed?

I would like to allow an external company to send new contact data to our mautic. I thought they could do that by using the [Create Contact](https://developer.mautic.org/?#create-contact) API call. But once I hand out an API key, the owner would be able to do all kinds of API calls, right? This would be problematic eg. for privacy and security reasons. Or can I somehow restrict which calls are allowed?

---

<div class="post-metadata">

**Author:** ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)\
**Post date:** [October 13, 2023, 12:23pm UTC](https://forum.mautic.org/t/can-i-restrict-api-access/29630/2 "2023-10-13T12:23:32Z")

</div>

I do not think, Mautic offers that at this time.

A workaround would be to restrict calls on the webserver level and just allow call to createContact from specific IP. and deny all other requests to an api.

Of course this is not ideal solution, but maybe it can cover your case.

Regards, M.

---

<div class="post-metadata">

**Author:** ![dirk\_s](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dirk_s/32/748_2.png) [@dirk\_s](https://forum.mautic.org/u/dirk_s)\
**Post date:** [October 13, 2023, 2:44pm UTC](https://forum.mautic.org/t/can-i-restrict-api-access/29630/3 "2023-10-13T14:44:28Z")

</div>

For basic auth you could add that API user to a certain group with restricted rights. So I guess this user will be limited to this allowed scenarios no matter whether using the GUI or the API access.

I would expect that - but its yet to be confirmed.

---

<div class="post-metadata">

**Author:** ![rihab\_bourbia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/rihab_bourbia/32/12037_2.png) [@rihab\_bourbia](https://forum.mautic.org/u/rihab_bourbia)\
**Post date:** [May 27, 2024, 2:50pm UTC](https://forum.mautic.org/t/can-i-restrict-api-access/29630/4 "2024-05-27T14:50:26Z")

</div>

> [@gwentara](#):
>
> is would be problematic eg. for privacy and security reasons. Or can I somehow restrict which calls are allowed?

any information about the possibility to set access right to external platform to limit them on which action they could perform (which feature they could use, level of access right [ie: Read a/o Write], …) ?

---

<div class="post-metadata">

**Author:** ![peter\_k](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/peter_k/32/511_2.png) [@peter\_k](https://forum.mautic.org/u/peter_k)\
**Post date:** [May 27, 2024, 6:09pm UTC](https://forum.mautic.org/t/can-i-restrict-api-access/29630/5 "2024-05-27T18:09:39Z")

</div>

Generally speaking: A user interacting with the API can do the same things as in the dashboard. This is controlled by the role you assign to them.

Here’s a guide on [how to use the Mautic API](https://audienture.com/how-to-use-the-mautic-api/#manage-security). It discusses permissions, too.