In https://suggestions.simplemdm.com/forums/204404-suggestions/suggestions/32990482-scope-api-key API permissions were split up to correspond with API endpoints. While a welcome change, it doesn't go far enough in providing granular access to sensitive MDM actions. Since the the /devices endpoint contains so much (device update, info, restart, shut down, lock, erase, etc.) it is a prime target were an API key to be compromised.

I am asking for API permissions to be split up to be even more granular by MDM command. An API key which only needs to enable/disable remote desktop should not also be able to lock or wipe the device. While I don't want permissions to become overly complex and thus difficult to configure, I do want to have confidence API keys aren't overly permissive.

I'm asking..
- Split out all MDM commands into their own API permission. Admins will need to specifically allow commands when creating/updating an API key.
- When creating a new API key, default all permissions to none. Currently permissions for all resources are allowed by default. Should start with least privilege.