Read-only access to API

Configuration
1

Hi!

I want to extract history data for a few sensors to populate an e-ink display. I have a Python script running on another node querying the Home Assistant API /api/history/period/... endpoint, rendering the graphics and sending them to the display; that works well.

However, for security reasons, I’d like to limit that script to being able to get history data, but not allow it to make any changes, including state changes of any smart plugs, thermostats, etc.; it can read whatever, I don’t care, but it shouldn’t be able to make any changes (esp. not changes with real-world effects).

I can’t figure out how to do this. A separate non-admin user appears to still be able to set states, and I haven’t been able to find a way to limit long-lived tokens to specific HTTP methods or endpoints or otherwise limit what they can do. Is there an idiomatic way to do this in Home Assistant that I’ve missed?

Thanks!

Best,
Felix

1 Like
2

Seems I missed read-only users, that appears to do just what I want. I’ve created a new user named readonly via the UI, then edited .storage/auth to set their group from system-users to system-read-only. Logged in as user readonly, none of the toggles work (as expected) and a long-lived token created as that user is still able to query history data via the API.