[debug] -> GET https://mail.example.com/api/schema
[debug] <- GET https://mail.example.com/api/schema status=403 Forbidden content-type=application/problem+json content-length=126 content-encoding=identity
warning: failed to refresh schema (permission denied (HTTP 403)); using cached copy
[debug] -> GET https://mail.example.com/jmap/session
[debug] <- GET https://mail.example.com/jmap/session status=403 Forbidden content-type=application/problem+json content-length=126 content-encoding=identity
error: permission denied (HTTP 403)
If I grant the token the same permissions as the admin account it works properly, but I would like to minimize the token’s permissions. Which permissions are required to reload TLS certificates from the CLI?
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
This confirms it: any request must first pass authentication (which requires the Authenticate permission), before the specific action permission (ActionReloadTlsCertificates) is checked. So the token needs both authenticate and action-reload-tls-certificates, plus likely being able to fetch /jmap/session which requires just authenticate.
This confirms it: the authenticate permission is required for a token to be able to sign in / access the API and JMAP session at all, separate from the actionReloadTlsCertificates permission needed to perform the reload action itself.
Required permissions for the token:
authenticate (Sign in to the server) — needed just to establish the session, this is what’s causing your 403 on /api/schema and /jmap/session
actionReloadTlsCertificates (Action: Reload: TLS certificates) — needed to actually perform the reload
Grant both of these (rather than full admin) to the token, and the CLI command should succeed with minimal privileges.
For reference: the actions doc describes ReloadTlsCertificates at Actions | Stalwart and the full permission list (including authenticate and actionReloadTlsCertificates) is at Permissions | Stalwart
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.
This was not a complete solution, but additional debugging logs got me the information I needed. The required permissions for the token are authenticate, actionReloadTlsCertificates, and sysActionCreate. In the web UI they are called, “Sign in to the server”, “Action: Reload: TLS certificates”, and “Actions Management: Create actions” respectively.