# How do AAP/AWX applications work - aka why doesn't it work

**URL:** <https://forum.ansible.com/t/how-do-aap-awx-applications-work-aka-why-doesnt-it-work/5286>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [May 4, 2024, 10:23am UTC](https://forum.ansible.com/t/how-do-aap-awx-applications-work-aka-why-doesnt-it-work/5286 "2024-05-04T10:23:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\
**Post date:** [May 4, 2024, 10:23am UTC](https://forum.ansible.com/t/how-do-aap-awx-applications-work-aka-why-doesnt-it-work/5286/1 "2024-05-04T10:23:21Z")

</div>

In AAP (2.4) I setup an application for Prometheus to monitor the AAP metrics, this application points to the API metrics endpoint.

I also created a “mortal”, a.k.a. non-admin user and generated a token to access the metrics to use in Prometheus.

But I constantly get an “Access denied”. When I use an admin user everything works as I want.

Am I thinking wrong or am I running into a bug?

---

<div class="post-metadata">

**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\
**Post date:** [May 4, 2024, 10:37am UTC](https://forum.ansible.com/t/how-do-aap-awx-applications-work-aka-why-doesnt-it-work/5286/2 "2024-05-04T10:37:18Z")

</div>

So, what we’re trying to accomplish is to have a token which is permitted to access a single URI in AWX/AAP.

Currently this occurs:

```console
$ curl -sSf -H "Authorization: Bearer jFGD1eQHXTF8M0F1z8Cl5UHoe265Iv" https://awx.example/api/v2/metrics/
curl: (56) The requested URL returned error: 403

```

I’ve toyed with giving the user whom the token belongs to all manner of roles, but I can’t get it to work for a non-admin user.

And if the token does belong to a user with admin rights, it (the token) can access any URL, e.g. list jobs, etc.