PIM Manager settings · Settings > Access requests
API keys
| Key | RfaApiKeys |
|---|---|
| Where | Settings > Access requests (RFA) > RFA broker & API |
| Type | List |
| Default | No keys |
| Feature | Access request portal: switch on an account, or get temporary group access · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
Keys for systems that cannot use an Entra application token to call the access request API. Each key has a name, scopes (requests.write to submit, requests.read to read status) and a lifetime of 1-3650 days. The key is shown once; only its hash is stored. It is sent as the X-Api-Key header. A key can be limited to the groups it may request (Groups); without a list it may request every group offered for ad-hoc access.
When set
When a key is created: the next request-portal sync (within a minute or two) publishes its hash to the portal, and a caller with requests.write can then ask for admin accounts to be enabled or timed group memberships to be added -- approved on arrival (a Tier 0 or Tier 1 group, or one with no tier set, waits for a person) and applied by the engine on its next run.
When blank or default
When no key exists (the default) or a key is revoked: calls with it are refused. The engine refuses a revoked key at once; the portal stops accepting it within a few minutes.
Risk and how to reverse it
Anyone holding a write key can grant timed privileged access without an approver in PIM Manager. A key cannot be shown again; if it leaks, revoke it. Expired keys stop working by themselves. Revoking does not end access already granted -- it runs until its end time.
Requires
Pro (access request API). SuperAdmin to create, list and revoke keys. The request portal must be deployed.
Recommended
Prefer an allow-listed Entra application. If you need a key, give it only the scope it needs and the shortest lifetime that works, and store it in a secret vault.
Related settings
- Request for authorization (RFA) portal FeatureGates.rfa.portal
- Access request API (REST, for ServiceNow and other systems) FeatureGates.api.broker
- Company name PortalBranding.CompanyName
- Support e-mail PortalBranding.SupportEmail
- RFA store account RfaBroker.StoreAccount
- Public portal URL RfaBroker.PortalUrl
- API applications (client ids) RfaBroker.ApiAppIds
- Ad-hoc groups consultants may request RfaBroker.AdHocGroups
- Default ad-hoc length (hours) RfaBroker.AdHocHours
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack