[ApiKeySettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
Personal API keys (publishing keys): doc/eng-us/guides/api-keys.md. A signed in user with the apikey/create policy makes keys on the API access page (apikey/list) and sends one as "Authorization: Bearer expk_<id>_<secret>". The request runs as the key's owner, limited to the key's scopes. Administrators see and revoke every key at oauthadmin/keys.
File
settings/rest.ini; override it in settings/override/rest.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| ApiKeys | enabled | enabled or disabled. Disabled: no key is accepted and none can be made; the pages say so. |
| ExpiryChoices[] | 7; 30; 90; 365; 0 | The lifetimes offered when a key is made, in days. 0 = does not expire, offered only when MaxExpiryDays is 0. |
| DefaultExpiryDays | 90 | The lifetime chosen when the form opens. |
| MaxExpiryDays | 365 | The longest lifetime a key may have, in days; 0 = no limit (keys that never expire are allowed). |
| MaxKeysPerUser | 10 | How many keys that are not revoked or expired one user may have; 0 = no limit. |
| LastUsedInterval | 60 | last_used and last_ip of a key are written at most once in this many seconds, so a busy key does not write the database on every request. |
| RateLimitPerMinute | 120 | Requests per minute one key may send; 0 = no limit. Counted in APCu (per PHP-FPM pool or per application server); without APCu the limit is not enforced and oauthadmin/keys says so. |
| Scopes[<key>] | read=content/read; publish=content/create; edit=content/edit; remove=content/remove; help=exphelp/context; graphql:read=content/read; graphql:write=content/edit; migration:read=migration/read | The scopes a key can be given: <scope>=<module>/<function> of the policy the owner needs for it, checked when the key is made and again on every request. |
| ScopeNames[<key>] | read=Read content; publish=Create and publish content; edit=Edit content; remove=Remove content; help=Read context help; graphql:read=Read content through GraphQL; graphql:write=Change content through GraphQL; migration:read=Read the state of the migrations | |
| DefaultReadScope | read | The scope a route needs: <controller class>_<action>=<scope>. A GET or HEAD route that is not listed needs DefaultReadScope; any other route that is not listed is refused for a key. |
| RouteScopes[<key>] | ezp7xRestContentController_CreateContentNode=publish; ezp7xRestContentController_UpdateContentNode=edit; ezp7xRestContentController_DeleteContentNode=remove; expHelpRestController_topic=help; expHelpRestController_manual=help; expGraphQLRestController_query=graphql:read; expGraphQLRestController_subscribe=graphql:read; expMigrationRestController_status=migration:read; ... | |
| RouteGuards[<key>] | ezp7xRestContentController_CreateContentNode=create; ezp7xRestContentController_UpdateContentNode=edit; ezp7xRestContentController_DeleteContentNode=remove | The owner's rights checked on the node a write route acts on: create (content/create of the posted classIdentifier under the posted parentNodeID), edit or remove (the route's nodeId). |
| ExamplePath | (empty) | The REST path the API access page shows in its curl examples, after ApiPrefix. Empty: a node read of the ezp provider, /ezp/v2/... with the ezprestapi extension, /ezp/v1/... otherwise. |
See also
Generated example: rest.ini [ApiKeySettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/rest.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment