Skip to content

Missing dedicated privilege for accessing REST API documentation #961

Closed

Description

@erathaowl

Describe the bug

The REST API documentation page (/api/v2/documentation) does not have a dedicated privilege available in pfSense's Assigned Privileges list.

Currently, granting access to this page appears to require the WebCfg - All pages (page-all) privilege, which provides significantly broader permissions than necessary.

This prevents administrators from allowing restricted users to access the API documentation without granting excessive permissions.

To Reproduce

  1. Go to System > User Manager.
  2. Create or edit a non-administrative user or group.
  3. Open Assigned Privileges and click Add.
  4. Search for a privilege related to REST API documentation.
  5. Notice that no dedicated privilege is available.
  6. Attempt to grant access to /api/v2/documentation without assigning WebCfg - All pages.

Expected behavior

A dedicated privilege, such as WebCfg - REST API Documentation, should be available under Assigned Privileges.

This would allow administrators to grant access to the Swagger/OpenAPI documentation independently of other WebGUI pages.

Access to individual API endpoints should continue to be governed by their existing permissions.

Screenshots or Response

N/A

pfSense Version & Package Version

  • pfSense Version: 2.9.0
  • Package Version: v2.10.2

Affected Endpoints

  • URL: /api/v2/documentation

Additional context

This is particularly relevant when configuring limited-access users that need to consult the API swagger documentation while following the principle of least privilege.

Ideally, the package should register this privilege automatically during installation, making it available through the standard pfSense privilege management interface.

Activity

  1. jaredhendrickson13 commented on Oct 30, 2026

    @jaredhendrickson13
    Member

    I'll have this included in the next release. The intent was for the documentation to not require privileges at all to access, since it's all public information anyway. Seems newer versions of pfSense enforce permissions on all pages now regardless, which makes sense.

    It's also worth noting that the same documentation is public at https://pfrest.org/api-docs/ as well, just without the "Try it out" capability. It's usually not necessary to access the documentation within the pfSense UI unless you are testing, developing the package, or you are using an older package version where the schema has diverged from the latest release.

    Thanks!

  2. linked a pull request that will close this issuev2.11.0 Fixes & Features #959on Oct 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementIssues or PRs that enhance existing features

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions