System Administrator getting 401-unauthorized error from API call

[kirby hawkes]

I am a System Administrator and while some API calls work, some are returning 401-Unathorized error.

Get version info - works:
https://xx.xx.xx.xx:8446/sepm/api/v1/version

Get domain info - works:
https://xx.xx.xx.xx:8446/sepm/api/v1/domains

Get client info (method 1) - does not work:
https://xx.xx.xx.xx:8446/sepm/api/v1/computers

Get client info (method 2) - does not work:
https://xx.xx.xx.xx:8446/sepm/api/v1/groups/FCBA64A90A1B2A1B01B4A6FE5DA8D8D6/computers


Invoke-RestMethod : The remote server returned an error: (401) Unauthorized.

[alexandrpaliy]

Not sure if I'm talking about absolutely the same issue, but, at least, recently I've faced some related one.
Taking an API reference as a background ( https://apidocs.symantec.com/home/saep#_symantec_endpoint_protection_manager_rest_api_reference ), methods 3.127 (GET /api/v1/stats/autoresolved/{reportType}/{startTime}/to/{endTime}) and 3.143 (GET /api/v1/version) worked fine.
But, for example, method 3.65 (GET /api/v1/groups) resulted in "The user is not authorized to access this resource" (unfortunately, I don't remember, which HTTP response status it gave - 401 or not), despite the fact, that I was authorized to API as one of SEPM admins and that admin is able to do all admin's stuff via SEPM GUI.

Did not open any support cases about this, though.

[Joe Cestra]

I am having a similar issue was this ever resolved for you? Broadcom support told me they don't assist with API issues.

[Aaron Auseth]

There are 3 types of administrator accounts.  Make sure the account you use for the API call is a System Administrator.

[Pawel Lesniewski]

Is there a way to allow an (not system) Administrator or Limited Administrator to access the group as read only? This action is alowed in the web console.

thanks 
-- 
Pawel

[Russ_V]

Hi Pawel,

Thanks for your question.  Yes, it is possible to create a "read only" user.  You would need to create a Limited Administrator per the example below: 



For more info about the differences between Administrator accounts, see this link: 
https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/managing-groups-clients-and-administrators/managing-administrator-accounts-v17364367-d1e6/about-administrator-accounts-and-access-rights-v9542187-d1e204.html

I hope this helps!

Thanks,

Russ_V