# Does the API user have to have full system access?

**URL:** https://forum.mautic.org/t/does-the-api-user-have-to-have-full-system-access/29308
**Category:** Product Support
**Created:** [September 15, 2023, 11:29pm UTC](https://forum.mautic.org/t/does-the-api-user-have-to-have-full-system-access/29308 "2023-09-15T23:29:41Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![johnwick](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/johnwick/32/3279_2.png) [@johnwick](https://forum.mautic.org/u/johnwick)
#### Post date: [September 15, 2023, 11:29pm UTC](https://forum.mautic.org/t/does-the-api-user-have-to-have-full-system-access/29308/1 "2023-09-15T23:29:41Z")

</div>

I’ve created a role specifically for the API user to limit possible security issues. However, even with all boxes checked, it’s unable to connect to Mautic, producing a 401 access denied error, unless granted full access.

When I give it the Administrator role, everything works fine.

What’s going on here? Bug? Feature?

---

<div class="post-metadata">

### Author: ![mzagmajster](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/mzagmajster/32/687_2.png) [@mzagmajster](https://forum.mautic.org/u/mzagmajster)
#### Post date: [September 17, 2023, 6:24pm UTC](https://forum.mautic.org/t/does-the-api-user-have-to-have-full-system-access/29308/2 "2023-09-17T18:24:55Z")

</div>

That might be true for some endpoints, but not for all in my opinion. Just now I am looking into LeadApiController and see that the controller actually checks for leda:leads permissions.