Werk #19886: Fix service discovery REST API permissions
| Component | REST API | ||||||
| Title | Fix service discovery REST API permissions | ||||||
| Date | Aug 11, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Bug Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
Previously, the service discovery REST API endpoints (getting the discovery result, waiting for a discovery run to complete, and updating a service's discovery phase) required the "Read access to all hosts and folders" permission unconditionally. This permission is normally reserved for administrators.
As a result, users who could only access a host through their contact group's folder permissions - without holding the blanket "Read access to all hosts and folders" permission - were rejected with:
We are sorry, but you lack the permission for this operation. If you do not like this then please ask your administrator to provide you with the following permission: 'Read access to all hosts and folders'.
even though they were otherwise allowed to see and manage that host.
These endpoints now use the same per-host, contact-group-aware permission check already used by the host configuration REST API endpoints. Users with folder-scoped access can now run and inspect service discoveries via the REST API without needing the global "Read access to all hosts and folders" permission.