Create Feature Service webhook via administrative API - 403 error

Question

We are on ArcGIS Enterprise 11.3 and dabbling with feature service webhooks for the first time. We have been able to successfully set them up and use them via the admin portal. ESRI documentation indicates that users not assigned the admin role should also be able to create feature service webhooks via the administrative API.

https://enterprise.arcgis.com/en/portal/latest/administer/windows/create-webhooks.htm

We have followed the disparate breadcrumbs across several pages to assign the proper privileges, generated a token to access the administrative API, but when sending a call to create a webhook we are receiving a 403 HTTP error which seems to indicate "Insufficient Permissions"

I will elaborate on our workflow thus far below.

https://developers.arcgis.com/rest/enterprise-administration/server/create-webhook/

In our test environment, we have configured a user with the Publisher role and assigned the Feature Layer privilege, the View All Content privilege, and the Publish server-based layers privilege. The user is the owner of the content for which we are attempting to create the webhook. The service has editing and change tracking enabled (without sync).

We generated a Client ID/Client secret and used these in order to generate a token using the OAUTH2 workflow (using the Authorize and Token endpoints as described below).

https://developers.arcgis.com/rest/users-groups-and-items/authentication/

https://developers.arcgis.com/rest/users-groups-and-items/authorize/

https://developers.arcgis.com/rest/users-groups-and-items/token/

We can successfully generate a token following these steps. Then when attempting to create a feature service webhook with the "Create" endpoint, we're getting the 403 HTTP error, which seems to indicate "Insufficient Permissions". Below is the URL format that we are using

https://<root>/services/Placehloder_serviceName/FeatureServer/webhooks/create

As far as I can tell, we have followed the workflow as prescribed. What additional steps can we take to try to get the API to successfully create a webhook?

(and while we're talking feature service webhooks, I'll just say that you should be able to set these up directly from the Settings page of the feature service if you are the content owner. Requiring an admin or a complicated multi-part api  process is too cumbersome for something like this.)

NathanGEOregon · Answer

Thanks for the recommendation - I had asked our admin team to enable privileges for all three that were indicated (Feature Layer privilege, View All Content privilege, and Publish server-based layers privilege)

I will have them double-check to make sure Publish server-based layers is enabled for the user. This may be a privilege that they prefer not to grant in our production environment though. Is there a technical reason why a user is required to have this ability? From my perspective, the Publish server-based layers privilege is providing more authority than should be needed to create a simple feature service webhook.

Annie_K · Answer

You're correct in that the 403 error you're hitting is almost certainly related to privileges settings. You indicated that you have set up "feature service" permissions for the user, which is halfway there. I would then double check that the custom role also has the following privilege set:

Any custom roles that include a webhook-related privilege must also include the general Publish server-based layers content privilege.

If that still doesn't resolve the issue, I would recommend setting your Server and Portal logs to DEBUG level, then try the workflow. This should generate a more useful, more descriptive error in your relevant logs, giving you more info to troubleshoot this error.