<p>I'm trying to access the Argo workflow archive via the REST API. The <a href="https://argoproj.github.io/argo-workflows/access-token/" rel="nofollow noreferrer">documentation</a> states that I need to create a role and a token, so I that's what I did. A role with minimal permissions can be created like so:</p>
<pre><code>kubectl create role jenkins --verb=list,update --resource=workflows.argoproj.io
</code></pre>
<p>And in fact this works, I can now access the argo server with a command like <code>curl http://localhost:2746/api/v1/workflows/argo -H &quot;Authorization: $ARGO_TOKEN&quot;</code>.
However it seems that more permissions are needed to access endpoints such as <code>/api/v1/archived-workflows</code>, because all I get there is this:</p>
<pre><code>{
  &quot;code&quot;: 7,
  &quot;message&quot;: &quot;permission denied&quot;
}
</code></pre>
<p>Presumably I need to specify other verbs and/or resources in the <code>kubectl create role</code> command, but I don't know which ones, and I can't find the relevant documentation. Any hints?</p>

Matthias Berndt
<p>Looks like the role/serviceaccount/rolebinding created according to the docs only grant permissions to list Workflows in the <code>argo</code> namespace (whether archived or not).</p>
<p>The namespace can be specified for the Archive like so:</p>
<pre class="lang-sh prettyprint-override"><code>curl http://localhost:2746/api/v1/archived-workflows?listOptions.fieldSelector=metadata.namespace=argo -H &quot;Authorization: $ARGO_TOKEN&quot;
</code></pre>
