1

Looking for the latest information on controlling user API access, as the last post I see is from 2013, where the best advice was essentially to audit the list of connected applications periodically. Every time I audit that list I lose a few days off my life, so I am hoping that there are better options now.

Specifically, using connected apps with the new-ish API client whitelisting functionality appears like it might provide granular controls.

What I need to understand is whether I, as an admin, can create a connected app for any oAuth endpoint, thereby having complete control over which apps can be used by which user.

Or, does the connected app need to be provided by the app developers, in which case if a user needs access to an app that does not come with a connected app, the user must be granted the 'Use any API client' permission, which would give them access to all apps.

Thanks

Improve this question

1 Answer 1

Reset to default
1

The connected app must be provided (packaged) by the app vendor. You as an admin then can use the packaged connected app to grant access on profile/permission set level.

In case a user must use an app, that does not provide an connected app, you must use the right 'use any api client' (will be appear after api-whitelisting is enabled in your organisation), which like you stated give this user access to all apps. 'api enabled' must be granted to all users, who want to use a connected app and is independent from api-whitelisting.

SEE: Control Individual API Client Access

Improve this answer
2
  • Thanks I had a feeling that was the case. Still better than before, as users will need to ask for permission to go rogue. I updated my question to the right permission (use any API client) when white listing is enabled.
    – gorav
    Apr 22, 2016 at 11:33
  • You can also try to contact the app vendors if they not package a connected app. Sometimes it is just a reason of adding an already existing connected app to the package.
    – lgraf
    Apr 22, 2016 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.