Question How to restrict customer access the REST API?

[Kaspar]

Server operating system version

Almalinux 9

Plesk version and microupdate number

18.0.81

As of Plesk 18.0.79 the REST API is available for use customers and resellers too by default. I rather not have my customer access the REST API. How do I limit the REST API usage to the administrator only?

 

[learning_curve]

As of Plesk 18.0.79 the REST API is available for use customers and resellers too by default. I rather not have my customer access the REST API. How do I limit the REST API usage to the administrator only?

Can't verify the answer below, as we don't have that requirement (so it's not been tested by us) but, after quickly simulating this requirement (using our servers' common specs for the simulation) Perplexity says: Yes! So you could try this and confirm that the simulation is accurate, in the real world too.

Copied and pasted:

Yes. In Plesk Obsidian 18.0.79 and later, you can restrict REST API access to administrator accounts by disabling the **Ability to use remote API** permission for reseller and customer accounts. This is controlled through permissions—not by a separate `panel.ini` switch. Plesk’s current documentation states that reseller/customer API access is permission-based, while the global API settings only enable/disable API access or restrict source IPs.[1][2]

## How to restrict access

### Resellers

For each reseller plan:

1. Go to **Service Plans**.
2. Open the relevant **Reseller Plan**.
3. Go to **Permissions**.
4. Clear **Ability to use remote API**.
5. Apply the change to existing reseller subscriptions/accounts if Plesk offers that option.

The permission determines whether a reseller can remotely manage websites through custom applications.[2]

### Customers

For customer subscriptions:

1. Go to **Service Plans**.
2. Open the relevant customer service plan.
3. Go to **Permissions**.
4. Clear **Ability to use remote API**.
5. Synchronize existing subscriptions, or clear the permission directly in the affected subscription.

If customer accounts are allowed to inherit permissions from their service plan, removing the permission at the plan level is the simplest approach.

### Additional administrators

For restricted additional administrator accounts, clear **Ability to use remote API** under:

**Tools & Settings → Restricted Mode Settings → Administrative Tools**

The main administrator is not affected by this permission and retains REST API access. Plesk documents that restricted additional administrators require this permission to use the remote API.[3]

### `panel.ini` settings

`allowedIPs` with a `/32` mask permits API connections only from `34.254.37.129`; it does **not** distinguish between administrator, reseller, and customer credentials. Therefore, combine the IP restriction with the account-level **Ability to use remote API** permission.

Ensure the actual file syntax uses the exact parameter names supported by Plesk, for example:

```ini
[api]
enabled = true
allowedIPs = 34.254.37.129
allowedNetworkMask = 32
allowPlainHttpAccess = false
```

Do not use separate section headers for each setting, and do not include stray characters such as `L` or `@`.

## Important distinction

This controls the **new REST API**. The legacy XML API has separate behavior: Plesk documents that XML API access may be available to administrators, resellers, and customers, with customer access enabled by default and not generally disableable per customer.[4]

To make the server administrator-only in practice, also review or disable XML API access if it is not required, for example:

```ini
[api]
enabled = false
```

However, that disables both XML API and REST API globally, so do not use it if the administrator must continue using REST API. In that case, keep `enabled = true`, retain the IP restriction, remove **Ability to use remote API** from reseller/customer plans and subscriptions, and verify that customers cannot authenticate successfully against `/api/v2/`.

Sources
[1] Plesk Obsidian 18.0.79: Security Audit, Expanded REST API, and ... Plesk Obsidian 18.0.79: Security Audit, Expanded REST API, and Microsoft SQL Server 2025 Support - Plesk
[2] Permissions | Plesk Obsidian documentation Permissions
[3] Creating Session Tokens via REST API - Plesk Documentation Creating Session Tokens via REST API
[4] About XML API | Plesk Obsidian documentation About XML API
[5] docs.plesk.com › en-US › obsidianCreating Session Tokens via REST API | Plesk Obsidian ... Creating Session Tokens via REST API
[6] Can Resellers or Customers in Plesk use Plesk REST API? https://support.plesk.com/hc/en-us/...lers-or-Customers-in-Plesk-use-Plesk-REST-API
[7] About REST API | Plesk Obsidian documentation About REST API
[8] Restricting Administrative Access Restricting Administrative Access
[9] About REST API | Plesk Onyx documentation About REST API
[10] Managing Reseller Accounts | Plesk Obsidian documentation Managing Reseller Accounts
[11] Integration and Automation Capabilities Integration and Automation Capabilities
[12] Restricting Remote Access via Plesk API Restricting Remote Access via Plesk API
[13] Reference | Plesk Obsidian documentation Reference
[14] Viewing Permissions | Plesk Obsidian documentation Viewing Permissions
[15] Integration and Automation Capabilities Integration and Automation Capabilities
[16] Plesk in Restricted Mode | Plesk Obsidian documentation Plesk in Restricted Mode
[17] Integrate with Plesk Service Plans Integrate with Plesk Service Plans
[18] Introduction | Plesk Obsidian documentation Introduction

 

[Kaspar]

I somehow missed this can be managed from the Service Plan permission. Which is great. Shame it got enabled by default on existing server installations for each service plain. It's plain to disable this manually.