Cameron
Today an API key is created at the account user level and inherits that user’s visibility across every organization in the account. There is no way to issue a key that can only see a subset of orgs.
As an MSP we want to expose Huntress data to internal tooling (MCP server, scripts, dashboards) with different trust levels.
Two examples-
  1. A key for our technicians that can query all client organizations but not our own internal Protek org.
  2. Compliance-driven scoping, for example a key used by out-of-country staff that is limited to the orgs they are cleared for, or a client-specific key for a regulated tenant (CMMC / ITAR) that cannot read other clients’ data.
The workaround is a dedicated user account per scope, which is clumsy to manage and still exposes everything that user can see.
Ask: let an account admin set an org allowlist (or denylist) on an API key at creation time, independent of the creating user’s own access.