I was initially using the administrator account to query CUMI to obtain voicemail records per user object id. Once I had it working, I wanted to create a service account and use that instead in my app. I created a user account from Unity Administration with adminstrator template, went to Roles page, removed System Aministrator and added Mailbox Access Delegate Account to the roles list. When I used this account in my app, I got 401 Unauthorized error. I went back and added Audit Administrator role because this was the only other role administrator account had, but still getting same error 401 unauthorized. Any ideas what's going on?

Akanksha, thanks for your reply. In order to create a user with voicemailusertemplate, I need to give it a phone extension for the voice mailbox. But this is just a service account. What would you suggest?

you can assign that user with "User Administrator" role and you will be able to get user objectid from /vmrest/users

Anil/Akanksha, I’m having difficulty understanding the roles – specifically Mailbox Access Delegate - and their intended use/audience. From your response it seems I’m not making sense in the Cisco universe. I’ll try to explain little better:

I’m developing some very basic reports for call records (called/received/unanswered/unreturned etc. etc.). I’m aware there are 3rd party software that do that but for sake of simplicity let’s assume they don’t exist.
The reporting app will use a service account to get the job done. And will need certain permissions/roles.

Please help me out here understand the roles here:


1. /vmrest/mailbox (CUMI) can return voicemail records of *anyone*, if, ALL THREE of the following are true:

a) Service account is created using voicemailusertemplate template

b) Mailbox Access Delegate role is assigned to the service account

c) User Object Id is provided

2. /vmrest/users (CUNI) can return User Object Id of *anyone*, if, following is true:

a) System Administrator role is assigned to the service account

So at the end of the day – the service account needs to have mailbox delegate role as well as sysdamin role. Why in the world would I want to give a little service account, whose job is to give me voicemail records (just an extension of CDR call log), the *All Powerful* System Administrator Role? The account does not need to LISTEN to voice messages (which I’d assume will require some God role). All it needs is called party, calling party and time received.

Please understand I’m a programmer and need to convince my CUCM sysadmin to give my little service account this role, so I’d appreciate some insight as to why Cisco chose to design roles in this manner? I’m definitely missing some point ☺
Thanks for your continued responses!