# API access for Nexpose when authenticating via Insight

**URL:** <https://discuss.rapid7.com/t/api-access-for-nexpose-when-authenticating-via-insight/22458>\
**Category:** API\
**Created:** [April 27, 2023, 1:09pm UTC](https://discuss.rapid7.com/t/api-access-for-nexpose-when-authenticating-via-insight/22458 "2023-04-27T13:09:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lleica-jrobertson](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@lleica-jrobertson](https://discuss.rapid7.com/u/lleica-jrobertson)\
**Post date:** [April 27, 2023, 1:09pm UTC](https://discuss.rapid7.com/t/api-access-for-nexpose-when-authenticating-via-insight/22458/1 "2023-04-27T13:09:36Z")

</div>

I’d like to use the Nexpose v3 API as per [InsightVM API (v3)](https://help.rapid7.com/insightvm/en-us/api/index.html)

However my org has moved to the InsightVM Platform Login

I can access the API and JSON results via a browser once authenticated - What are the best practices in this situation?

(I know it’s unsupported, but ideally i’d be building off [GitHub - rapid7/vm-console-client-python: the UNOFFICIAL (but useful) Python library for the Rapid7 InsightVM/Nexpose RESTful API](https://github.com/rapid7/vm-console-client-python) )

---

<div class="post-metadata">

**Author:** ![john\_hartman](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/john_hartman/32/1255_2.png) [@john\_hartman](https://discuss.rapid7.com/u/john_hartman)\
**Post date:** [April 28, 2023, 2:12pm UTC](https://discuss.rapid7.com/t/api-access-for-nexpose-when-authenticating-via-insight/22458/2 "2023-04-28T14:12:50Z")

</div>

While that Github repo is assumable old (~ 3 years old) it was designed by a member of my team and can be very useful.

For your purposes, I would just create a separate user account on your console designed specifically for use with the API. Within the InsightVM console there is no concept of API permissions, it’s just a user account that has specific permissions to do what it needs to do within the tool.

---

<div class="post-metadata">

**Author:** ![lleica-jrobertson](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@lleica-jrobertson](https://discuss.rapid7.com/u/lleica-jrobertson)\
**Post date:** [May 2, 2023, 2:39am UTC](https://discuss.rapid7.com/t/api-access-for-nexpose-when-authenticating-via-insight/22458/3 "2023-05-02T02:39:51Z")

</div>

There does not seem to be a python library that supports the okta-emea type logins unfortunately

I’ve had some success with getting the cookies from a browser session and passing them on to wget to provide some basic scripting capability

I’ll see if i am able to get a service style account for API access configured - thanks

Regards

james