# Read-only User for SEMP API

**URL:** <https://community.solace.com/t/read-only-user-for-semp-api/2105>\
**Category:** Solace Event Broker\
**Created:** [January 3, 2025, 11:48am UTC](https://community.solace.com/t/read-only-user-for-semp-api/2105 "2025-01-03T11:48:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GurpreetKaur](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/gurpreetkaur/32/2275_2.png) [@GurpreetKaur](https://community.solace.com/u/GurpreetKaur)\
**Post date:** [January 3, 2025, 11:48am UTC](https://community.solace.com/t/read-only-user-for-semp-api/2105/1 "2025-01-03T11:48:54Z")

</div>

Is it possible to create a read-only user to access the SEMP API using the Solace Cloud console if my user has the role of account administrator ?

---

<div class="post-metadata">

**Author:** ![GurpreetKaur](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/gurpreetkaur/32/2275_2.png) [@GurpreetKaur](https://community.solace.com/u/GurpreetKaur)\
**Post date:** [January 3, 2025, 2:09pm UTC](https://community.solace.com/t/read-only-user-for-semp-api/2105/2 "2025-01-03T14:09:22Z")

</div>

We are unable to execute the CLI commands so wanted to try creating the user directly from console.

---

<div class="post-metadata">

**Author:** ![Aaron](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/aaron/32/843_2.png) [@Aaron](https://community.solace.com/u/Aaron)\
**Post date:** [January 3, 2025, 2:24pm UTC](https://community.solace.com/t/read-only-user-for-semp-api/2105/3 "2025-01-03T14:24:41Z")

</div>

Hey @GurpreetKaur , no a Solace Cloud admin account cannot create new SEMP/CLI users… only a “global” admin of the broker can do that.

Note that most Solace Cloud brokers will have two users automatically created for it… the regular admin account (which is actually a VPN-level read-write user), and a viewer account (a global read-only user). In your Cloud Console, find the service, click on “Manage”, then under “Broker Manager - Web Application” change the drop-down to “Viewer” and copy the username / pw from there. That is the global read-only account you seek:

 ![image.png](https://canada1.discourse-cdn.com/solace/original/2X/6/6186edaf4102b864297fa7059b00af47e1fd3bc2.png)

Let me know if that works for you.

---

<div class="post-metadata">

**Author:** ![GurpreetKaur](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/gurpreetkaur/32/2275_2.png) [@GurpreetKaur](https://community.solace.com/u/GurpreetKaur)\
**Post date:** [January 6, 2025, 12:13pm UTC](https://community.solace.com/t/read-only-user-for-semp-api/2105/4 "2025-01-06T12:13:49Z")

</div>

Hey @Aaron , thanks for the detailed explaination. I was able to find this global read-only user. This will work for us. We don’t have to create any new user then as it already serves the purpose.

---

<div class="post-metadata">

**Author:** ![Aaron](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/aaron/32/843_2.png) [@Aaron](https://community.solace.com/u/Aaron)\
**Post date:** [January 6, 2025, 2:27pm UTC](https://community.solace.com/t/read-only-user-for-semp-api/2105/5 "2025-01-06T14:27:36Z")

</div>

Note for any future readers: starting with SolOS 10.9.1 (which came out recently), the “admin” account that Solace Cloud automatically provisions for managing the Solace Cloud service also has global read-only permissions for the broker, so both the “admin” and “viewer” accounts will be able to do global / broker-level CLI and SEMP commands… well, read-only `show` commands. But if you’re building a monitoring app, or providing credentials for someone just to view, then still use the “viewer” account (fully read-only).