Why can't Administrators create API Tokens?

Question

It makes no sense that Administrators cannot themselves create API Tokens (e.g for new API-only users in a read-only role).

I have to either:

Ask someone to demote my account (e.g. to the “manager” role)
Create the API Token
Ask them to promote my account back to the administrator role

OR

Create myself a second identity (which is contrary to our security policy).

OR

Create an API Token creation tool to bypass this nonsense.

abhishek_bhambo · Answer

The LogicMonitor REST API will allow you to programmatically query and manage your LogicMonitor resources: dashboards, devices, reports, services, alerts, collectors, datasources, SDTs and more.	This key has FULL access to all the components across LM, API keys are used for programatic access to an LM Portal	The combination of out-of-box (OOB) admin permissions with the use of an API token can create a risk of the token becoming compromised which may cause unnecessary havoc in an LM Envision portal.	Customers can create a new role, link it to the new or existing user and assign all the permission needed to perform their task.&nbsp;	If the user is already linked to an Administrator role, he has all the privileges to&nbsp;demote himself to Manage&nbsp;role, no need to ask someone

abhishek_bhambo · Answer

@pgordon&nbsp;: Re:&nbsp;second admin account for myself just for this purpose:&nbsp;Customers can create a new role or switch to an existing non-administrator role (OOB ), link it to the new or existing user as per their needs&nbsp;and assign all the permission needed to perform their task. No need to create another admin account.Re: we should have the option to allow or disable being able to create tokens by roleyes that option is still there and will continue to exist.

anonymous · Answer

I cloned the admin role and moved my admins into that role. IIRC that removes that restriction since you are only restricted if you are in the built in admin role.

sambhaji_kadam · Answer

Any user except an out-of-the-box administrator user role can create API tokens. Ensure to check the&nbsp;Allow Creation of API Token&nbsp;checkbox under Settings&gt; User Profile.

david_bond · Answer

@Sambhaji Kadam&nbsp;Yes. And I understand that LogicMonitor is protecting us from ourselves by not permitting administrators to create API tokens for their own user.My point it that administrators should not be prevented from creating API-only users.