GraphQL API Permissions

[ingel81]

Unraid Connect: 2025.09.23.2013
Unraid: 7.1.4

if you create a READONLY API Token (Role: Viewer) with READ_ANY everywhere,
you can use it to start and stop containers and VMs.

mutation Stop($stopId: PrefixedID!) {
  docker {
    stop(id: $stopId) {
      status
    }
  }
}

Didn't try more.

[elibosley]

Thank you. We'll patch this ASAP.

[ingel81]

Additional finding:

if one creates a fine tuned API token like that:

and does this query with it:

query Me {
  me {
    id
    name
    description
    roles
    permissions {
      resource
      actions
    }
  }
}

Response:

{
   "errors":[
      {
         "message":"Unauthorized",
         "locations":[
            {
               "line":2,
               "column":3
            }
         ],
         "path":[
            "me"
         ],
         "extensions":{
            "code":"UNAUTHENTICATED",
            "originalError":{
               "message":"Unauthorized",
               "statusCode":401
            }
         }
      }
   ],
   "data":null
}

Would expect to get the list of permissions.

This works with the static role tokens like ADMIN or VIEWER.

Response in this case is below, but here i would expect all detailed permissions in the array also.

3rd Party applications need to check their exact permissions to allow things or deny things with your API based on this info.

{
   "data":{
      "me":{
         "id":"6fce4cedecb829f1f45a2e8bc6d7d78e6445801d1a72a0431a996f282e3f6443:83041f26-3855-4627-aa84-4e3b569b3017",
         "name":"iobrokerdev",
         "description":"API Key iobrokerdev",
         "roles":[
            "VIEWER"
         ],
         "permissions":[
            
         ]
      }
   }
} 

Should i report more things if i find more or is this known and not finished yet?

[elibosley]

This is super helpful. Feel free to add any other findings here.