Werk #22711: New permission "See pending changes" for the REST API
| Component | REST API | ||
| Title | New permission "See pending changes" for the REST API | ||
| Date | Oct 28, 2026 | ||
| Level | Trivial Change | ||
| Class | New Feature | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
You can now let a role list the pending changes through the REST API without
allowing it to activate them. The new permission See pending changes, next to
Activate configuration in the Setup permissions, grants access to the endpoint
Show all pending changes (GET /domain-types/activation_run/collections/pending_changes)
on its own. Until now, this endpoint required Activate configuration. Roles with
Activate configuration can still list the pending changes, with or without the
new permission.
The built-in roles Administrator and Normal monitoring user have the new permission by default, and custom roles inherit it from the role they are based on. The update revokes it from every role that has Activate configuration revoked, so these roles still can't list the pending changes.
The permission only applies to the REST API. Revoking it doesn't hide the pending changes in the GUI.