Here a basic PowerShell that sets vars.agent of a host by an api user
$paswd = ConvertTo-SecureString "xxx" -AsPlainText -Force
$cred = New-Object Management.Automation.PSCredential ('myuser', $paswd)
Invoke-RestMethod -Uri "https://monitoring.host.tld/director/host?name=$(Get-IcingaHostname -AutoUseFQDN $true -LowerCase $true)" -Method Get -Headers @{"Accept"="application/json"} -Credential $cred
Invoke-RestMethod -Uri "https://monitoring.host.tld/director/host?name=$(Get-IcingaHostname -AutoUseFQDN $true -LowerCase $true)" -Method Post -Headers @{"Accept"="application/json"} -Credential $cred -Body (@{"vars.agent"=$true} | ConvertTo-Json)
Invoke-RestMethod -Uri "https://monitoring.host.tld/director/host?name=$(Get-IcingaHostname -AutoUseFQDN $true -LowerCase $true)" -Method Get -Headers @{"Accept"="application/json"} -Credential $cred
(You can skip the Get commands in production and catch error 304 if the host already has this flag.
The role for the user needs just 3 permissions:
