# Using Keycloak admin APIs without using master realm user details

**URL:** <https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001>\
**Category:** Miscellanaeous\
**Created:** [January 12, 2022, 11:01am UTC](https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001 "2022-01-12T11:01:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kurianbenoy-aot](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kurianbenoy-aot/32/4096_2.png) [@kurianbenoy-aot](https://forum.keycloak.org/u/kurianbenoy-aot)\
**Post date:** [January 12, 2022, 11:01am UTC](https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001/1 "2022-01-12T11:01:07Z")

</div>

I wanted to modify the group attributes in a particular realm using keycloak APIs. How can I dot it, without creating a new user/existing user credentials as part of master realm.

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [January 12, 2022, 11:59am UTC](https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001/2 "2022-01-12T11:59:13Z")

</div>

Any user with the `manage-groups` role in that realm will be able to use the Admin API to modify group attributes.

---

<div class="post-metadata">

**Author:** ![kurianbenoy-aot](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kurianbenoy-aot/32/4096_2.png) [@kurianbenoy-aot](https://forum.keycloak.org/u/kurianbenoy-aot)\
**Post date:** [January 13, 2022, 3:37am UTC](https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001/3 "2022-01-13T03:37:45Z")

</div>

> [@xgp](#):
>
> `manage-groups` role

@xgp isn’t manage-group role available only in master realm. If I don’t have access to master realm, then what will I do?

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [January 13, 2022, 8:46am UTC](https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001/4 "2022-01-13T08:46:48Z")

</div>

No. It’s in the `realm-management` client roles. Go into the user in that realm you want to grant the role. select `realm-management` from the “Client roles” dropdown". Select `manage-users` (sorry, there is no `manage-groups`, but you need `manage-users` in order to modify groups).

 ![Screen Shot 2022-01-13 at 9.44.27 AM](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/c75717685be5d88d98887c99750681ad67631c51.png)

---

<div class="post-metadata">

**Author:** ![kurianbenoy-aot](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kurianbenoy-aot/32/4096_2.png) [@kurianbenoy-aot](https://forum.keycloak.org/u/kurianbenoy-aot)\
**Post date:** [January 13, 2022, 11:25am UTC](https://forum.keycloak.org/t/using-keycloak-admin-apis-without-using-master-realm-user-details/13001/5 "2022-01-13T11:25:13Z")

</div>

@xgp this approach works. Another approach I found is using a client credential as grant-type with a Service account will also give me access to generating tokens