You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Missing dedicated privilege for accessing REST API documentation #961
The REST API documentation page (/api/v2/documentation) does not have a dedicated privilege available in pfSense's Assigned Privileges list.
Currently, granting access to this page appears to require the WebCfg - All pages (page-all) privilege, which provides significantly broader permissions than necessary.
This prevents administrators from allowing restricted users to access the API documentation without granting excessive permissions.
To Reproduce
Go to System > User Manager.
Create or edit a non-administrative user or group.
Open Assigned Privileges and click Add.
Search for a privilege related to REST API documentation.
Notice that no dedicated privilege is available.
Attempt to grant access to /api/v2/documentation without assigning WebCfg - All pages.
Expected behavior
A dedicated privilege, such as WebCfg - REST API Documentation, should be available under Assigned Privileges.
This would allow administrators to grant access to the Swagger/OpenAPI documentation independently of other WebGUI pages.
Access to individual API endpoints should continue to be governed by their existing permissions.
Screenshots or Response
N/A
pfSense Version & Package Version
pfSense Version: 2.9.0
Package Version: v2.10.2
Affected Endpoints
URL:/api/v2/documentation
Additional context
This is particularly relevant when configuring limited-access users that need to consult the API swagger documentation while following the principle of least privilege.
Ideally, the package should register this privilege automatically during installation, making it available through the standard pfSense privilege management interface.
I'll have this included in the next release. The intent was for the documentation to not require privileges at all to access, since it's all public information anyway. Seems newer versions of pfSense enforce permissions on all pages now regardless, which makes sense.
It's also worth noting that the same documentation is public at https://pfrest.org/api-docs/ as well, just without the "Try it out" capability. It's usually not necessary to access the documentation within the pfSense UI unless you are testing, developing the package, or you are using an older package version where the schema has diverged from the latest release.
Activity
feat(PrivilegesCache): add static privilege for /api/v2/documentation…
jaredhendrickson13 commentedon Oct 30, 2026
I'll have this included in the next release. The intent was for the documentation to not require privileges at all to access, since it's all public information anyway. Seems newer versions of pfSense enforce permissions on all pages now regardless, which makes sense.
It's also worth noting that the same documentation is public at https://pfrest.org/api-docs/ as well, just without the "Try it out" capability. It's usually not necessary to access the documentation within the pfSense UI unless you are testing, developing the package, or you are using an older package version where the schema has diverged from the latest release.
Thanks!
feat(PrivilegesCache): add static privilege for /api/v2/documentation…