The INETAPP server provides API access to a given set of functions. Users must have the Web API access permission to use it. Furthermore users may be required to have permissions for specific functions as well.
The following list of API end-points is available to the current user:
WEB-API-EXTENSIONS-LIST
The response area of the Web API remote GUI consists of the request URL, the response status code and -message. An option panel allows to toggle the preview mode (on by default).
If the response status message wasn't set it will display a generic message (three points: ...
). This usually happens when an API points send back binary data.
Note: Binary data responses can result in a Download button being display instead of a JSON (or other available formats) response. The request is performed again when clicking the Download button. That means that the command will be executed on the server twice.
The preview mode is an option at the response panel of the Web API Remote GUI. If enabled it will send additional information to the server which can decide to not actually execute a given command.
If a command is executed with actual data in preview mode heavily depends on the command. Usually the preview mode makes sense for potentially destructive commands like delete
.
Request to the Web API require proper authentication. Many of the pre-installed authentication provider support the BASIC authentication scheme.
# REQUEST POST /api HTTP/1.1 Authorization: Bearer VGhpcyBpcyBqdXN0IGEgZGVtbyBhY2Nlc3MgdG9rZW4u Content-Type: application/json
Authentication using the BASIC authentication scheme creates a session. It is recommended to reuse this session for subsequent requests. Otherwise the server will potentially create a huge amount of sessions that are not really required. Each session takes up memory, slowing down the server.
To prevent this issue from happening accidentally or by DOS, there is an additional defender plugin which allows only a certain amount of sessions being created within a given time. It will then block the user and IP from logging in.
Solution: You should either reuse the session for a large amount of subsequent requests _or_ use the Token Authentication plugin. This plugin does not create sessions even though it does log in the user for each request.