Work order update via Maintenance API fails with 403 Forbidden error

ERP Infor CloudSuite
, , , , , , , ,
1

Our maintenance automation is completely blocked because the Maintenance API returns 403 Forbidden when we try to update work order status. We can successfully retrieve work orders via GET requests, but any PUT or PATCH operation fails with authorization errors.

The error response:

{
  "status": 403,
  "message": "Forbidden: Insufficient permissions"
}

We’ve verified that our API user has the Maintenance Manager role in CloudSuite, but something in the security policy configuration or API role mapping isn’t translating those permissions to the API endpoints. The endpoint permissions seem to require something beyond the standard CloudSuite roles. How do we properly configure API role mapping for maintenance operations?

2

403 errors with API access usually mean the user has CloudSuite permissions but not API-specific permissions. Check if your API user is assigned to an API security role in Infor OS Portal, not just CloudSuite roles.

3

Here’s the complete solution addressing all three security configuration areas:

API Role Mapping: First, you need to create and assign proper API roles in Infor OS Portal:

  1. Navigate to Security > API Roles > Create New Role

  2. Create a role named “Maintenance_API_Full_Access”

  3. Add these permission groups:

    • `maintenance.workorder.read
    • `maintenance.workorder.write
    • `maintenance.workorder.update
    • maintenance.asset.read (required for work order context)

  4. Assign this API role to your service account:

    • Go to Security > Service Accounts > [Your API User]
    • Add Role: “Maintenance_API_Full_Access”
    • Save and sync permissions (can take 5-10 minutes)

The key issue is that CloudSuite application roles (like Maintenance Manager) don’t automatically grant API permissions. You must explicitly assign API-specific roles.

Security Policy Configuration: Next, configure the security policy for maintenance endpoints:

  1. Go to API Management > Security Policies
  2. Find or create policy: “Maintenance API Policy”
  3. Configure allowed operations:
<security-policy name="maintenance-api-policy">
  <resource path="/maintenance/workorders/*">
    <method name="GET" role="maintenance.workorder.read"/>
    <method name="PUT" role="maintenance.workorder.update"/>
    <method name="PATCH" role="maintenance.workorder.update"/>
  </resource>
</security-policy>
  1. Apply this policy to the Maintenance API service

Endpoint Permissions: Finally, configure specific endpoint permissions:

  1. Navigate to API Management > Endpoints > Maintenance API

  2. Find the work order update endpoint: `/api/v1/maintenance/workorders/{id}

  3. Edit endpoint security settings:

    • Authentication: Required (OAuth2 Bearer Token)
    • Authorization: API Role Based
    • Required Roles: `maintenance.workorder.update
    • Allowed Methods: GET, PUT, PATCH

  4. Configure field-level permissions for work order updates:

    • Status updates: Requires `maintenance.workorder.update
    • Assignment changes: Requires `maintenance.workorder.assign
    • Cost updates: Requires `maintenance.workorder.cost.update If you’re updating specific fields like costs or assignments, you may need additional granular permissions.

Testing the Configuration: After applying these changes:

  1. Wait 10 minutes for permission sync
  2. Obtain a new OAuth2 token (old tokens won’t reflect new permissions)
  3. Test with a simple status update:
PUT /api/v1/maintenance/workorders/WO12345
{
  "status": "IN_PROGRESS"
}

Common Issues:

  • 403 persists after role assignment: Clear API Gateway cache and obtain new token
  • Works for some work orders but not others: Check asset-level security permissions
  • Can update status but not other fields: Add field-specific permissions to API role
  • Intermittent 403 errors: Token expiration - implement proper token refresh logic

Additional Considerations for ICS 2021:

  • The API role system in ICS 2021 requires explicit endpoint mapping - there are no wildcard permissions
  • If you need to update work orders across multiple sites, add maintenance.site.access permission
  • For automated workflows, consider creating a dedicated service account rather than using a personal user account

This complete configuration ensures your API user has proper permissions at all three levels: API role, security policy, and endpoint access. The automation should now successfully update work orders without 403 errors.

4

Check the security policy configuration for the Maintenance API in Infor OS Portal. Navigate to API Management > Security Policies and verify that the work order update endpoints are included in your API role’s allowed operations. In ICS 2021, there’s often a disconnect between application permissions and API endpoint permissions that requires explicit mapping.

5

I’ve seen this before with maintenance APIs. The issue is that CloudSuite application roles don’t automatically map to API permissions. You need to create an API role in Infor OS that explicitly grants access to the maintenance endpoints, then assign that API role to your service account. The Maintenance Manager role in CloudSuite gives UI access but doesn’t grant API access by default.

6

Don’t forget about the security context inheritance. Even with correct API roles, the work order update operation might require additional CloudSuite permissions like asset access or location permissions depending on what fields you’re updating. The 403 could be triggered by field-level security, not just endpoint-level.