diff --git a/Web/Lang/en/messages.mo b/Web/Lang/en/messages.mo
index f4942c9..99b75ba 100644
Binary files a/Web/Lang/en/messages.mo and b/Web/Lang/en/messages.mo differ
diff --git a/Web/Lang/en/messages.po b/Web/Lang/en/messages.po
index 5ce9842..2af3fdf 100644
--- a/Web/Lang/en/messages.po
+++ b/Web/Lang/en/messages.po
@@ -5801,3 +5801,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Lang/fr/messages.mo b/Web/Lang/fr/messages.mo
index 270ba0d..b26c9bf 100644
Binary files a/Web/Lang/fr/messages.mo and b/Web/Lang/fr/messages.mo differ
diff --git a/Web/Lang/fr/messages.po b/Web/Lang/fr/messages.po
index 5c5dbc6..aab42b0 100644
--- a/Web/Lang/fr/messages.po
+++ b/Web/Lang/fr/messages.po
@@ -5812,3 +5812,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Lang/ja/messages.mo b/Web/Lang/ja/messages.mo
index 23611eb..ff2641b 100644
Binary files a/Web/Lang/ja/messages.mo and b/Web/Lang/ja/messages.mo differ
diff --git a/Web/Lang/ja/messages.po b/Web/Lang/ja/messages.po
index 778a963..3fa316e 100644
--- a/Web/Lang/ja/messages.po
+++ b/Web/Lang/ja/messages.po
@@ -5875,3 +5875,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Lang/ko/messages.mo b/Web/Lang/ko/messages.mo
index 3b6e026..13c6d0e 100644
Binary files a/Web/Lang/ko/messages.mo and b/Web/Lang/ko/messages.mo differ
diff --git a/Web/Lang/ko/messages.po b/Web/Lang/ko/messages.po
index 929cdc1..a9c0167 100644
--- a/Web/Lang/ko/messages.po
+++ b/Web/Lang/ko/messages.po
@@ -5817,3 +5817,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Lang/pl/messages.mo b/Web/Lang/pl/messages.mo
index 27eec5f..94bcaad 100644
Binary files a/Web/Lang/pl/messages.mo and b/Web/Lang/pl/messages.mo differ
diff --git a/Web/Lang/pl/messages.po b/Web/Lang/pl/messages.po
index 76f85e4..cf3b8f3 100644
--- a/Web/Lang/pl/messages.po
+++ b/Web/Lang/pl/messages.po
@@ -5811,3 +5811,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Lang/pt/messages.mo b/Web/Lang/pt/messages.mo
index 5bf7e77..4cb2573 100644
Binary files a/Web/Lang/pt/messages.mo and b/Web/Lang/pt/messages.mo differ
diff --git a/Web/Lang/pt/messages.po b/Web/Lang/pt/messages.po
index 82c24aa..82b2862 100644
--- a/Web/Lang/pt/messages.po
+++ b/Web/Lang/pt/messages.po
@@ -5812,3 +5812,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Lang/ru/messages.mo b/Web/Lang/ru/messages.mo
index 4ec2afb..7f092cc 100644
Binary files a/Web/Lang/ru/messages.mo and b/Web/Lang/ru/messages.mo differ
diff --git a/Web/Lang/ru/messages.po b/Web/Lang/ru/messages.po
index 2822839..898883f 100644
--- a/Web/Lang/ru/messages.po
+++ b/Web/Lang/ru/messages.po
@@ -5811,3 +5811,6 @@ msgstr "The OS profiles define the Bacularis and Bacula install and configuratio
 
 msgid "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
 msgstr "Roles define the Bacularis resources to which users can have access. Roles enable to organize the web interface to give selected users limitted access to some resources, pages and functions. One user can have assigned one or more roles."
+
+msgid "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
+msgstr "Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited."
diff --git a/Web/Pages/Security.page b/Web/Pages/Security.page
index 676c46d..34d7d67 100644
--- a/Web/Pages/Security.page
+++ b/Web/Pages/Security.page
@@ -1755,7 +1755,7 @@ $(function() {
 				<div class="w3-container w3-margin-left w3-margin-right w3-margin-top">
 					<div class="w3-row directive_field">
 						<div class="w3-col w3-third"><com:TLabel ForControl="UserAPIHostList" Text="<%[ API host: ]%>"/></div>
-						<div class="w3-half w3-show-inline-block">
+						<div class="w3-twothird w3-show-inline-block">
 							<com:TActiveDropDownList
 								ID="UserAPIHostList"
 								CssClass="w3-select w3-border"
@@ -1779,6 +1779,19 @@ $(function() {
 									}
 								</prop:ClientSide.OnComplete>
 							</com:TActiveDropDownList>
+							<i class="fas fa-info-circle help_icon w3-text-green" onclick="$('#help_user_api_hosts').slideToggle('fast');"></i>
+							&nbsp;<i class="fa fa-asterisk w3-text-red opt_req" style="vertical-align: top"></i>
+							<br />
+							<com:TRequiredFieldValidator
+								ControlCssClass="field_invalid"
+								Display="Dynamic"
+								ControlToValidate="UserAPIHostList"
+								ValidationGroup="UserAPIHostResourceAccessGroup"
+								ErrorMessage="<%[ Field required. ]%>"
+							/>
+							<div id="help_user_api_hosts" class="directive_help" style="display: none">
+								<%[ Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited. ]%>
+							</div>
 						</div>
 					</div>
 					<div id="user_access_window_select_access" style="display: none">
@@ -4598,7 +4611,7 @@ $(function() {
 			<div class="w3-container w3-margin-left w3-margin-right w3-margin-top">
 				<div class="w3-row directive_field">
 					<div class="w3-col w3-third"><com:TLabel ForControl="APIHostGroupAPIHostList" Text="<%[ API host: ]%>"/></div>
-					<div class="w3-half w3-show-inline-block">
+					<div class="w3-twothird w3-show-inline-block">
 						<com:TActiveDropDownList
 							ID="APIHostGroupAPIHostList"
 							CssClass="w3-select w3-border"
@@ -4622,6 +4635,19 @@ $(function() {
 								}
 							</prop:ClientSide.OnComplete>
 						</com:TActiveDropDownList>
+						<i class="fas fa-info-circle help_icon w3-text-green" onclick="$('#help_group_api_hosts').slideToggle('fast');"></i>
+						&nbsp;<i class="fa fa-asterisk w3-text-red opt_req" style="vertical-align: top"></i>
+						<br />
+						<com:TRequiredFieldValidator
+							ControlCssClass="field_invalid"
+							Display="Dynamic"
+							ControlToValidate="APIHostGroupAPIHostList"
+							ValidationGroup="APIHostGroupAPIHostResourceAccessGroup"
+							ErrorMessage="<%[ Field required. ]%>"
+						/>
+						<div id="help_group_api_hosts" class="directive_help" style="display: none">
+							<%[ Select an API host to set resources and permissions. Please note that the 'Main' API host is not listed because the 'Main' is the full access API host and it should not be limited. ]%>
+						</div>
 					</div>
 				</div>
 				<div id="api_host_group_access_window_select_access" style="display: none">
diff --git a/Web/Pages/Security.php b/Web/Pages/Security.php
index 3b1e628..8b2dad4 100644
--- a/Web/Pages/Security.php
+++ b/Web/Pages/Security.php
@@ -233,12 +233,12 @@ private function setRoles($control, $def_val = null)
 	 * @param object $control control which contains API host list
 	 * @param mixed $def_val default value or null if no default value to set
 	 * @param bool $add_blank_item determines if add first blank item
-	 * @param array $sel_api_hosts defines selected list of API hosts to set. If not set, all API hosts are taken
+	 * @param null|array $sel_api_hosts defines selected list of API hosts to set. If not set, all API hosts are taken
 	 */
-	private function setAPIHosts($control, $def_val = null, $add_blank_item = true, $sel_api_hosts = [])
+	private function setAPIHosts($control, $def_val = null, $add_blank_item = true, $sel_api_hosts = null)
 	{
 		$api_hosts = [];
-		if (count($sel_api_hosts) > 0) {
+		if (is_array($sel_api_hosts)) {
 			$api_hosts = $sel_api_hosts;
 		} else {
 			$host_config = $this->getModule('host_config')->getConfig();
@@ -2261,10 +2261,6 @@ public function loadUserAPIHostResourceAccessWindow($sender, $param)
 				$host_groups = $this->getModule('host_group_config');
 				$api_hosts = $host_groups->getAPIHostsByGroups($user_config['api_host_groups']);
 			}
-			if (count($api_hosts) == 1 && $api_hosts[0] === HostConfig::MAIN_CATALOG_HOST) {
-				$host_config = $this->getModule('host_config')->getConfig();
-				$api_hosts = array_keys($host_config);
-			}
 			// strip main API host
 			$cbf = function ($host) {
 				return ($host !== HostConfig::MAIN_CATALOG_HOST);