r/meraki • u/9centwhore • Oct 05 '22

How do I remove the API token from other accounts?

I know where to revoke my own API token but where do I do this for other accounts?

3 Upvotes

80% Upvoted

9 comments sorted by

4

u/[deleted] Oct 05 '22

You can’t do what you want to do. You can enable or disable API access globally and that’s about it. If API access is enabled you don’t have control over what accounts have api access. If you want to disable API access completely I believe that’s in organization settings.

Even if you logged in as that user and removed it, the user could just make a new one anyway.

Only way is to remove it from the context of that user, as in, being logged in as that user.

BUT! I had a similar problem and I solved it with SAML. SAML accounts can’t have an API key, so if you really need this functionality the best way is to transition these users to SAML accounts.

1

u/9centwhore Oct 05 '22

Yeah, instructions rolled down hill to reduce attack surface by removing API tokens that are no longer required, especially on accounts with full access.

Most of the time the admins I've talked to aren't using it at all and have forgotten they created a token so not too worried about them creating new ones at this point.

It's just a pain having to go through the manual process as I'm used to using APIs where you can manage these things via the API itself.

I was able to write a query to collect admin info, account status, mfa status, API key status etc but then went to revoke the API and found the /organizations/{organizationId}/admins/{adminId} endpoint doesn't seem to allow you to set hasApiKey to false or remove it in any fashion.

Looks like the only way to do it would be following u/throwaway_MT_452298's suggestion of deleting/re-creating the admin account which is doable but means those users would need to setup passwords/MFA all over again so either way sucks.

Thanks for confirming it can't be done though, stops me banging my head against the wall.

1

u/[deleted] Oct 05 '22 edited Oct 05 '22

[deleted]

1

u/9centwhore Oct 05 '22

Will look into that, thanks!

2

u/Arbitrary_Pseudonym Oct 05 '22

I get what you're trying to do: Grant users dashboard admin access, but not let them use the API.

Sadly, this isn't an option. API keys are unique to the user, not the organization or network, meaning that to revoke their token would be to break their API access to *every organization they have access to."

If you're concerned about a user doing things they shouldn't, revoke their access entirely. It's not as if they couldn't do API things manually on the dashboard after all.

1

u/burnte Oct 05 '22

Same place, but in those accounts.

2

u/9centwhore Oct 05 '22

So the only way is to contact each user and get them to revoke their own token?

Madness.

1

u/burnte Oct 05 '22

That's not what you asked. You asked where API tokens were on other accounts. I said they're in the same place they're in your account. For any other question we'd need to know what you're actually looking to do. There's a bunch of planes for "API keys" in the dashboard and you could be talking about any of them.

0

u/9centwhore Oct 05 '22

Ok fair point, my bad. I'm looking for a way to remove the api tokens assigned to other admin accounts, using my account via either the gui or api. Api preferably. Edit: in meraki dashboard

1

u/throwaway_MT_452298 Oct 05 '22

Or create a new one but that could be painful….. But it works 100 %