UniFi Protect Shouldn't Require an API Key as Using the API Key Requires Super Admin or Owner Credentials for the Entire Console

[charlestephen]

Feedback

To create an API key for UniFi Protect integration (or, indeed, UniFi Network), a super admin or owner credential is required. If, as is documented, expected, and best practice, a user account with least privileged access required to fulfill the role is create as a local user account, that account doesn't need to be a super admin on the console to work. As such, that account wouldn't be able to create an API key. To fulfill the minimum requirements of the integration setup screen, an API key is required. The documentation suggests creating an API from any standard admin account, which is incorrect and also very bad practice as API keys are unique to user accounts. The documentation is unclear on this point or that using an API key from a different user effectively grants your least privileged access user full system control.

URL

https://www.home-assistant.io/integrations/unifiprotect/

Version

2025.8.0

Additional information

No response

[home-assistant]

Hey there @RaHehl, mind taking a look at this feedback as it has been labeled with an integration (unifiprotect) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of unifiprotect can trigger bot actions by commenting:

• @home-assistant close Closes the feedback.
• @home-assistant rename Awesome new title Renames the feedback.
• @home-assistant reopen Reopen the feedback.
• @home-assistant unassign unifiprotect Removes the current integration label and assignees on the feedback, add the integration domain after the command.
• @home-assistant add-label needs-more-information Add a label (needs-more-information) to the feedback.
• @home-assistant remove-label needs-more-information Remove a label (needs-more-information) on the feedback.

[RaHehl]

We only use the API key. The decision to restrict its creation to admin accounts was made by Ubiquiti.

[charlestephen]

API keys grant use to all console API endpoints, including those for which a user may not be authorized to use. Allowing the documentation as it currently stands doesn't emphasize this point enough (nor the fact that creating an API key from a different account is a terrible idea). Moreover, the documentation says it requires an administrator account when it in fact requires a super administrator account. This completely destroys the idea of granting least privileged access to Home Assistant.

[RaHehl]

I’m not saying I disagree with the approach regarding the key, but this is still the wrong addressee. By the way, have you tried testing what you can actually do with the key? As far as I know, the API key can only be used to access the public API. Just as you can’t use WebGUI authentication to access the public API, you also can’t use the API key to access anything other than the public API, so having admin or super admin rights makes no difference here.

[charlestephen]

The documentation is Home Assistant's, not Ubiquiti's. That's why I'm trying to get it addressed here. You can do quite a lot with the API key, generally speaking, anything that you can do using the clients, but entirely automated. It also reveals certain aspects of your setup that aren't available via any client I've seen. (The network API does the same but there's a nice API browser for that which one can setup to see all the endpoints. As far as I know, there isn't an API browser for Protect.)

[wpnicknz]

I agree with @charlestephen . Particularly with the instructions to set up the API key with an administrator account. Since a username, password and key are required, the key should really belong to the same account - which as mentioned is required to be a super admin.

I stumbled across all of this because have been troubleshooting the sensors turning to "Unavailable" after around 10 minutes of an HA restart. Now that I have the key under the dedicated located account, the sensors are staying "Clear" (for now). Interestingly, according to the Unifi Console, the key is not accessed at all during this first 10 minutes of HA's startup.

I am not sure if it's the key ownership or simply the role permissions that has improved the sensor states, however configuring the integration as per the instructions seems to be causing problems.

[github-actions]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved.
If this issue is still relevant, please let us know by leaving a comment 👍
This issue has now has been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.