The Falcon Administrator role is the highest-level administrative role within the CrowdStrike Falcon console. It grants full read and write permissions across the platform. This includes critical configuration tasks such as creating, modifying, and revoking API clients and their associated keys. These keys are essential for securely integrating third-party applications and services with the Falcon platform's APIs. Therefore, only users assigned the Falcon Administrator role have the necessary privileges to manage these integrations.

A. Falcon Threat Hunter: This role is for proactive threat detection and investigation; it does not include administrative permissions for platform configuration or API management.

C. Falcon Viewer: This is a read-only role that cannot perform any write actions, including the creation or management of API keys.

D. Falcon Integrator: This is not a standard, predefined role in the CrowdStrike Falcon console. API management is a function of the Falcon Administrator role.

1. CrowdStrike Falcon Documentation

API clients and keys

"Create an API client" section. The documentation explicitly states: "To create an API client

you must have the Falcon Administrator role." This source directly confirms that API key creation is restricted to administrators.

2. CrowdStrike Falcon Documentation

User management

"Role descriptions" section. This section details the permissions for built-in roles

describing the Falcon Administrator as having "full read and write permissions to all information and actions in the Falcon console

" which encompasses API management. The descriptions for Viewer and Threat Hunter roles confirm their lack of administrative privileges.