API features and best practices for API token rotation #1891
|
What are the best practices for using the gitlab-API (i.e. python-gitlab project) to rotate API tokens? (By rotate API tokens, I mean create/delete/recreate and capture the API token value via the gitlab-API.) Can a user effectively read/rotate their own API token using the gitlab API token? Can an owner of a project use the gitlab API to read/rotate project API tokens? Can an admin of a group use the gitlab API to read/rotate group API tokens (and can those group API tokens access any projects in the group)? Where is the RBAC documentation on gitlab-API and various types of API tokens (user, project, group with token-scope details)? |
Replies: 1 comment 1 reply
|
Quick comment from my phone. The source of truth for the API is https://docs.gitlab.com/ee/api/ |
|
@dazza-codes python-gitlab is not the right place for these questions, we are only a client library. You'll need to ask this upstream at GitLab. But I can tell you you cannot create PATs via your own PAT unless you're an admin, since it's considered a security issue (as it could bypass revoking and expiring tokens by simply recreating new ones before the existing one is revoked). You can however rotate project/group access tokens with Maintainer or Owner access. You only get the token value on creation, you cannot get the value later with GET requests. |
Quick comment from my phone. The source of truth for the API is https://docs.gitlab.com/ee/api/