Add custom validation and/or permissions constraint support to the Token model #1052

New Issue

MrUnknownDE · 2026-04-05T20:06:13+02:00

MrUnknownDE commented

2026-04-05 20:06:13 +02:00

Originally created by @atownson on 10/15/2025

NetBox version

v4.4.4

Feature type

Change to existing functionality

Proposed functionality

Currently, custom validators are not processed for the Token model and default permissions allow users to view, create, edit, and delete tokens scoped to their user. This proposal requests adding the CustomValidationMixin to the Token model to enable validation support and/or remove the default permissions for the Token model (found in settings.py).

Example validator implementation (configuration.py):

class TokenValidator(CustomValidator):
    def validate(self, instance, request):
        if not request.user.is_superuser:
            self.fail('Only admins are able to create API tokens.')

CUSTOM_VALIDATORS = {
    'users.token': (
        TokenValidator(),
    )
}

Use case

The goal of this request is to allow some guardrails for token management by enabling custom validators and/or removing the default permissions for the Token model. Understandably, the default permissions allow users to utilize the NetBox API with the same permissions they have available via the UI. However, compared to SSO, API tokens can be easily compromised. Admins should be able to recreate the current default permissions found the settings.py if they choose to do so.

Potential use cases would be limiting the creation, modification, or deletion of tokens to specific users or groups, configuring a maximum expiration value, limiting tokens to read only, and applying a defined IP allow list.

Database changes

None

External dependencies

None

*Originally created by @atownson on 10/15/2025* ### NetBox version v4.4.4 ### Feature type Change to existing functionality ### Proposed functionality Currently, custom validators are not processed for the Token model and default permissions allow users to view, create, edit, and delete tokens scoped to their user. This proposal requests adding the `CustomValidationMixin` to the Token model to enable validation support and/or remove the default permissions for the Token model (found in settings.py). Example validator implementation (configuration.py): ``` class TokenValidator(CustomValidator): def validate(self, instance, request): if not request.user.is_superuser: self.fail('Only admins are able to create API tokens.') CUSTOM_VALIDATORS = { 'users.token': ( TokenValidator(), ) } ``` ### Use case The goal of this request is to allow some guardrails for token management by enabling custom validators and/or removing the default permissions for the Token model. Understandably, the default permissions allow users to utilize the NetBox API with the same permissions they have available via the UI. However, compared to SSO, API tokens can be easily compromised. Admins should be able to recreate the current default permissions found the settings.py if they choose to do so. Potential use cases would be limiting the creation, modification, or deletion of tokens to specific users or groups, configuring a maximum expiration value, limiting tokens to read only, and applying a defined IP allow list. ### Database changes None ### External dependencies None

MrUnknownDE closed this issue

2026-04-05 20:06:13 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#1052