how to write data via rest-api at port 3000

[szlf619]

I am trying to add a new software via localhost:3000, with a problem "401 Unauthorized"

When I use name 'navigator' with read-only, I can get the software data. I tried three accounts and go through the config file within the project, there are only 3 service roles "read-only", "stix-export","collection-manager".

How can I do the post operation? or is there anyother serviceRole with write permission to support 'Post' ?

rest-api-service-confg.json is set as follows:
{
"serviceAuthn": {
"challengeApikey": {
"enable": true,
"serviceAccounts": [
{
"name": "collection-manager",
"apikey": "sample-key",
"serviceRole": "collection-manager"
}
]
},
"basicApikey": {
"enable": true,
"serviceAccounts": [
{
"name": "navigator",
"apikey": "sample-key-1",
"serviceRole": "read-only"
},
{
"name": "apikey-test-service",
"apikey": "sample-key-2",
"serviceRole": "stix-export"
},
{
"name": "collection-manager",
"apikey": "sample-key-2",
"serviceRole": "collection-manager"
}
]
}
}
}
log：
2025-09-19 11:22:16 2025-09-19T03:22:16.647Z [HTTP] GET /api/software 200 90.058 ms - -
2025-09-19 11:22:16 2025-09-19T03:22:16.699Z [HTTP] POST /api/software 401 16.854 ms - 14
2025-09-19 11:22:16 2025-09-19T03:22:16.707Z [HTTP] POST /api/software 401 3.321 ms - 14
2025-09-19 11:22:16 2025-09-19T03:22:16.713Z [HTTP] POST /api/software 401 1.281 ms - 14

[seansica]

You're getting a 401 error because you're trying to POST to /api/software (or similar ATT&CK object endpoint) using a service role. The standard ATT&CK object endpoints (software, techniques, tactics, mitigations, groups, etc.) require a user account with a valid user role (editor, team_lead, or admin). Service accounts (API keys) cannot be used for regular user operations.

To create software objects via POST, you should create a user account with the appropriate role (editor, team_lead, or admin). Authenticate as that user when making POST/PUT requests.

The service roles you mentioned are uniquely limited to just a few endpoints:

Role	Authorized Endpoints
collection-manager	POST /api/collection-bundles PUT /api/collection-indexes/:id
stix-export	GET /api/stix-bundles

They are designed for service-based operations, not user-based operations!

Hope this helps!