hardening rest api sas viya

paterd2 — Thu, 05 Jun 2025 10:16:34 GMT

Viya Experts,

can we block the access to /identities/users and /identities/groups without breaking the applications in sas viya ?

every authenticated user can list all users and groups in our environment.

Or maybe even better are there hardening advices on the rules in sas viya.

Regards,

Dik

Re: hardening rest api sas viya

germhm — Mon, 16 Jun 2025 13:38:11 GMT

Hi Dik,

maybe this is helpful:

endpoints.secured.groups:	not enabled by default	When enabled, limits non-administrative users’ Read access for groups.
endpoints.secured.members:	not enabled by default	When enabled, limits non-administrative users’ Read access for group members.
endpoints.secured.memberships:	not enabled by default	When enabled, limits non-administrative users’ Read access for group and user memberships.
endpoints.secured.users:	not enabled by default	When enabled, limits non-administrative users’ Read access for other users.

best
Mike