Configuring security and permissions policies
Configure security and permission policies to control how API keys access data. Authorize each client integration (API key) to create, update, read, and delete only the required resource groups, and explicitly define which fields are exposed.
API keys without the appropriate security policies and permissions can’t access any data. Proper configuration ensures that each API key accesses only the data that has been explicitly defined and approved, helping maintain data security and visibility control.
Before you begin
-
You must have administrator or integrations access to the tenant.
-
You must be familiar with REST APIs and XML.
Steps
-
Log in to Professional.
-
From the left hand navigation menu, go to .
-
In the upper right corner, select Create Security Policy (+). The Add New Policy window appears.
-
In the General section:
-
Title: Enter a descriptive policy name, for example,
Client_SourceSystem_Worker_API. -
ID: Enter a unique identifier. Use letters, numbers, periods (
.), underscores (_), or hyphens (-).
-
-
In the Policy Type section, select Permit (default).
-
In the Actions section:
-
Select Read to allow data retrieval.
-
Select Create, Update, and/or Delete to allow data changes.
-
-
In the Policy Details section:
-
Actor Type: Select Integration Client.
-
Resource Group: Select the data group to control access. For example:
-
Reference Data: Access reference objects such as workers, users, organizations, and business sites.
-
Workers: Access worker-related data.
-
Engagements: Access engagement data associated with workers.
-
-
-
Select the Actor tab, then select Specific Integration Client.
-
From the Specific Integration Client drop-down menu, select the newly created API key.
-
Select the Resource tab and move the required fields from the Available fields column to Chosen fields.
-
Select Add. A Policy created message appears.
| Create a separate policy for each resource group (for example, Workers or Cost Centers). This approach enforces the principle of least privilege and simplifies troubleshooting and access management. |