# Limit access to Cumulocity Microservice REST API

**URL:** <https://community.cumulocity.com/t/limit-access-to-cumulocity-microservice-rest-api/7141>\
**Category:** Forum\
**Tags:** cumulocity\
**Created:** [August 25, 2020, 12:52pm UTC](https://community.cumulocity.com/t/limit-access-to-cumulocity-microservice-rest-api/7141 "2020-08-25T12:52:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![florian.gopp](https://avatars.discourse-cdn.com/v4/letter/f/d78d45/32.png) [@florian.gopp](https://community.cumulocity.com/u/florian.gopp)\
**Post date:** [August 25, 2020, 12:52pm UTC](https://community.cumulocity.com/t/limit-access-to-cumulocity-microservice-rest-api/7141/1 "2020-08-25T12:52:59Z")

</div>

Hi Guys,

I have several JAVA microservices running on Cumulocity.  
Most of the services are accessible by other external services and that is fine. But I have one service - which is used by the other services - for which the REST API it provides should not be accessible from “outside” of Cumulocity.

For example:  
c8y.MicroServiceA ----\> c8y.ManagementService … access ok  
c8y.MicroServiceB ----\> c8y.ManagementService … access ok  
ExternalService —X–\> c8y.ManagementService … no access  
Postman Client —X–\> c8y.ManagementService … no access

ManagementService is accessible by other services from “inside” the Cumulocity platform but not accessible for external services/clients.  
Is this possible?

Thanks!  
Best Regards,  
Florian

---

<div class="post-metadata">

**Author:** ![Gyan\_Awasthi1](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@Gyan\_Awasthi1](https://community.cumulocity.com/u/Gyan_Awasthi1)\
**Post date:** [August 26, 2020, 2:29am UTC](https://community.cumulocity.com/t/limit-access-to-cumulocity-microservice-rest-api/7141/2 "2020-08-26T02:29:19Z")

</div>

To be honest , I am not sure if I understood your query fully… However you can play around users and roles related to micro service to see if it help.  
There are three types of users:

- Tenant user: The user that invokes a microservice through its REST API endpoints /service// passed through by the proxy.
- Service user: A generated user that allows a microservice to access a subscribed tenant independent of a REST API invocation, e.g., for initialization or regular jobs.
- Microservice bootstrap user: A user passed to the microservice for requesting subscribed tenants and service users.

The following role types are defined for users:

- Required roles: The roles that are predefined to allow access to Cumulocity IoT Rest APIs. For instance, if a microservice creates measurements using the service user, measurement admin role must be added as a required role of the application. Required roles are added to the service users.
- Roles: The custom roles provided to tenant platform users by the microservice developer. These roles can be assigned or revoked to the tenant platform users or groups using the Administration application.

The roles are set in the [Microservice manifest](https://cumulocity.com/guides/microservice-sdk/concept/#manifest).

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [April 2, 2021, 3:45pm UTC](https://community.cumulocity.com/t/limit-access-to-cumulocity-microservice-rest-api/7141/3 "2021-04-02T15:45:06Z")

</div>

Closed on April 2, 2021, 3:45pm UTC