PIM Manager settings · Settings > Features & edition
Access request API (REST, for ServiceNow and other systems)
| Key | FeatureGates.api.broker |
|---|---|
| Where | Settings > Features & edition > Feature customization |
| Type | On / off |
| Default | Off |
| Feature | Access request portal: switch on an account, or get temporary group access · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
Accepts access requests that other systems (for example ServiceNow) send to the REST API on the public broker. A caller can ask for an admin account to be enabled, or a group membership, for a set time, and read or cancel the request. Callers use an allow-listed Entra application token or a PIM API key.
When enabled
On its next run (within a minute), the access-request job takes in API requests and decides them with the same rules as portal requests. Group requests become a time-limited active membership that is removed at the end. SuperAdmins can create API keys.
When disabled
Requests that arrive through the API are rejected with 'the access request API is not enabled here', and no new API keys can be created. Portal requests are not affected.
Risk and how to reverse it
Switching it on lets an external system, using a key or application you allowed, enable admin accounts and add group memberships for a time. Anyone holding a valid key can request access. Reversible: switch it off and new API requests are rejected on the next run. Requests already granted run until their end time.
Requires
A Pro licence (switching it on, or creating an API key, without one is refused). SuperAdmin to change it and to manage API keys. Depends on 'Request for authorization (RFA) portal' being on, and on the public broker being deployed.
Recommended
On only when a system such as ServiceNow will actually call it. Give each caller its own key with the narrowest scope and an end date.
Related settings
- Request for authorization (RFA) portal FeatureGates.rfa.portal
- Company name PortalBranding.CompanyName
- Support e-mail PortalBranding.SupportEmail
- RFA store account RfaBroker.StoreAccount
- Public portal URL RfaBroker.PortalUrl
- API applications (client ids) RfaBroker.ApiAppIds
- Ad-hoc groups consultants may request RfaBroker.AdHocGroups
- Default ad-hoc length (hours) RfaBroker.AdHocHours
- API keys RfaApiKeys
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack