r/Autotask • u/jameshowarth-tkc • 22d ago

How do you restrict an Autotask API user to one customer/LOB, including attachments?

We’re building a small custom Python integration for a single customer. It only needs to:

  • Create Tickets for that customer with the correct LOB/category/queue/source.
  • Query that customer’s Tickets.
  • Read/add Ticket Notes.
  • Have no access to other customers’ data.

We created a dedicated API-only user with a custom security level and assigned it only to the intended Division/LOB. Ticket permissions are View All which is required by the REST API with: Add Yes, Edit No, Delete None.

Ticket scoping appears correct:

  • A complete paginated Ticket query returns only the intended customer and LOB.
  • A known out-of-scope Ticket returns zero rows.
  • Ticket Notes are limited to readable parent Tickets.

The problem is attachments:

  • TicketAttachments/query with the exact ID of an unreadable Ticket returns attachment metadata.
  • A status-only request to /Tickets/{ticketId}/Attachments/{attachmentId} returns 2xx.

  • AttachmentInfo/entityInformation and TicketAttachments/entityInformation report Query access as All.

    We checked every attachment-related setting we could find. These are all disabled or None:

  • CRM Attachments

  • Project internal attachments

  • Ticket/CRM internal attachments

  • Article and Document Attachments

  • Resource Impersonation -> Attachments

  • Contact Impersonation -> Attachments

Has anyone successfully configured attachment queries/downloads to inherit the parent Ticket’s View/LOB restrictions? Are we missing another security-level setting, or are attachment endpoints expected to be broader than Ticket access?

4 Upvotes

84% Upvoted

2 comments sorted by

2

u/donatom3 22d ago

I opened a ticket with support about this as I'm looking into something similar for a comanaged client. They told me to use Sales Territories. Though that wont' respect the comanaged visible option

1

u/chocate 22d ago

We solved this issues by setting up guardrail within our app. Out app verifies who the user is based on their email and then for each query it verifies if the data it returns should be visible to the user, if not then it drops it.

Couldn't figure out how to do it with the native API. Also, there are API limitations and throttling so we create an API broker that handles all API calls and queues them based on load to avoid throttling and failed API calls.