Organizations using IBM API Connect Developer Portal often require different levels of access for users within a Consumer Organization (COrg). Currently, Consumer Organization roles such as Owner, Administrator, Developer, and Member do not support granular permission customization. As a result, all authenticated COrg users effectively receive the same portal-level permissions, making it difficult to enforce segregation of duties and least-privilege access principles.
This limitation creates challenges for enterprise customers who have strict governance, security, and compliance requirements around application ownership and credential management.
Current Limitation
Based on discussions with IBM Expert Labs, it has been confirmed that API Connect currently does not support creation of custom Consumer Organization roles with custom permissions, unlike the flexibility available for provider-side roles.
Organizations cannot, for example:
- Allow only COrg Owners and Administrators to create or manage applications.
- Allow Developers to view application details but prevent application creation or modification.
- Restrict Viewers from accessing application credentials or application administration screens.
- Create custom COrg roles aligned to internal organizational responsibilities.
Requested Enhancement
Introduce configurable Role-Based Access Control (RBAC) for Consumer Organizations within the Developer Portal.
The enhancement should allow administrators to:
- Create custom Consumer Organization roles.
- Define permission sets for each role.
- Assign permissions at a granular level.
- Map users to custom COrg roles.
- Manage permissions through both UI and APIs.
Example Permission Model
Capability |
Owner |
Admin |
Developer |
Viewer |
Create Applications |
Yes |
Yes |
No |
No |
Edit Applications |
Yes |
Yes |
No |
No |
Delete Applications |
Yes |
Yes |
No |
No |
View Applications |
Yes |
Yes |
Yes |
Optional |
View Credentials |
Yes |
Yes |
Yes |
No |
Manage Members |
Yes |
Yes |
No |
No |
Subscribe to APIs |
Yes |
Yes |
Yes |
No |
This is only an example; customers should be able to configure permissions according to their own governance requirements.
Business Impact
This enhancement would provide:
- Better compliance with enterprise security policies.
- Support for least-privilege access models.
- Improved separation of duties within Consumer Organizations.
- Reduced risk of unauthorized application creation or credential exposure.
- Greater flexibility for large organizations with multiple teams consuming APIs.
- Easier adoption of API Connect in regulated industries such as automotive, banking, healthcare, and public sector.
Use Case
A large enterprise may have multiple teams within the same Consumer Organization:
- API Owners must manage applications and credentials.
- Application Developers need visibility into applications but should not be allowed to create or modify them.
- Business Users may only require visibility into subscriptions and API products.
- Auditors may require read-only access.
Current capabilities do not allow these distinctions to be implemented effectively within a Consumer Organization.
Expected Outcome
Enable enterprises to implement granular, customizable Consumer Organization permissions in the Developer Portal, comparable to the role customization available on the provider side, improving governance, security, and operational flexibility.
Priority Justification :High
The requirement has been raised by multiple business stakeholders and impacts enterprise adoption scenarios where strict access governance and role segregation are mandatory.
