My comment about the UI was purely that, the API works 100% as expected, which assumes you've associated the RO account at the right level of the ESXi host.
Take a look at https://williamlam.com/2023/01/applying-additional-security-hardening-enhancements-in-esxi-8-0.html and specifically the following code snippet:
$authManager = Get-View $global:DefaultVIServer.ExtensionData.Content.AuthorizationManager
$rootFolderMoRef = (Get-Folder -Type Datacenter -Name root).ExtensionData.MoRef
# Give new local account administrative privileges
$newAdminAuthSpec = New-Object VMware.Vim.Permission
$newAdminAuthSpec.RoleId = -1 # Administrator
$newAdminAuthSpec.Propagate = $true
$newAdminAuthSpec.Principal = $newUserName
$authManager.SetEntityPermissions($rootFolderMoRef,@($newAdminAuthSpec))
# Remove administrative privileges from root user
$newRootAuthSpec = New-Object VMware.Vim.Permission
$newRootAuthSpec.RoleId = -5 # NoAccess
$newRootAuthSpec.Propagate = $true
$newRootAuthSpec.Principal = "root"
$authManager.SetEntityPermissions($rootFolderMoRef,@($newRootAuthSpec))
Note the $rootFolderMoRef variable which specifies the root of the ESXi Datacenter reference object and we're also propagating the role down. Make sure when you assign the role, you have something simliar or the RO will only apply at whatever level you've specified.
If you're using vCenter, @vsphere.local is just the local SSO Domain. Most organizations will have Active Directory which they can centrally manage credentials including expiring/changing passwords. If you have that, then you'll want to setup service account for the 3rd party software, this way you can track all usage. If you do not then you can certainly leverage the local SSO Domain and just create a new account for the 3rd party like thirdparty@vsphere.local and then assign RO at the appropriate inventory level.
I suspect you probably don't have the role assigned at the right level and hence you're seeing some strangeness, which would be expected if you're trying to access things further down inventory.
Not sure what you mean by FQDN or hostname ... by definition hostname = FQDN but I believe this comes from Windows world where hostname = short FQDN and not the full FQDN 🙂
