Dear Manager Support.
I have this worry about using the manager API,
I have noted two disturbing things.
When you create, update, or delete using the API, it records the user in the history as API. My worry is that this does not identify the person from whose account the API token was created. Is the API business-specific or user-specific? Also, if more than one person is using the API for a business, which is very feasible, how will you know who performed which action? This situation is very concerning, as we are dealing with financial data that is sensitive in many ways and needs to be tracked closely.
Using the API to pull data from the system appears to leave this action unrecorded in your history. This means someone could silently be stealing your data without your logs ever telling you about this action. This sounds very concerning, as someone can be illegally stealing your data and you will never know. Please help me understand if I am doing something wrong on my side, or if this is true, what is the rationale?
I think this is a good candidate for being placed under ideas
The previous api used to log the authenticating user.
Even though the new api do not keep track of users, however, each one of these tokens has a user defined name, which should make more sense than simply “API”.
And so does using stolen credentials. I believe that introducing such introsive surveillance measures would introduce overheads far outweighing any security benefits.
That being said, a subtler more cost effective methods like those already used for user session management, i.e. keeping track of IP, OS and device would make more business sense.
I agree with you @Ealfardan
If we could alternatively identify things like MAC address, IP, OS as you pointed out it will make business sense and also know when someone pulls data using the API. This is really critical.
