Forum Discussion

b_poplin's avatar
b_poplin
Expert
12 years ago

User-level API access to custom content

I can access custom content through API using an Admin role, but I get 303 permission denied with user-level role. API example: [server]/restapi/vc/categories/id/[categoryId]/settings/name/customcontent.20_text


Two Questions:
  1. Does anyone know how to access custom content through API with user-level roles?
  2. What role setting is denying access?
Thanks!
  • AdamN's avatar
    AdamN
    12 years ago

    To get a setting value for a lower-level node such as a category, you'll want to use the REST API. If you're getting a permission denied error, try using the restadmin context object instead of the rest context object. That's the point I'd suggest being careful about. If you're just using a hard-coded REST API path, there shouldn't be any risk assuming you're ok with exposing the content of that setting for everyone. I'd discourage the use of user input to construct the path when using the restadmin context object (ie. query string parameter).

  • AdamN's avatar
    AdamN
    Khoros Oracle
    12 years ago

    Unfortunately, I'm not sure there's going to be a good way to do this purely through the REST API. Although users can see the custom content in the UI, generally speaking users are not allowed to access the behind-the-scenes settings. To grant normal users the ability to see those settings through the REST API, you'd likely have to give them more permissions than desired (ie. the ability to edit/manage the node).

     

    What I would suggest instead is using a custom endpoint. Normally I'd urge caution about exposing settings through a custom endpoint, but if you're just displaying the custom content values then there probably isn't too much concern. Within your custom endpoint, you'd want to make a REST API call to grab the value of the custom content, and then you could output that in the endpoint.

     

    If you're not familiar with custom endpoints, you can learn more here:

    http://lithosphere.lithium.com/t5/developers-knowledge-base/Working-with-Lithium-Studio-Endpoints/ta-p/60240

    • b_poplin's avatar
      b_poplin
      Expert
      12 years ago

      ENDPOINTS looks like it could be the right solution, but I need some more advice.

       

      What I am trying to do:

      I am trying to access a custom content setting on a category.

       

      Try1: Fail (contentKey is custom content field name)

      <#assign cc = settings.name.get('${contentKey}')/>

       

      cc always returns custom content from Community level. 

       

      Try2: Use rest call in Endpoint, same problem "permission denied" as using full external rest call.

       

      Any idea how to get "settings.name.get('[customSetting]') to return a specific category level value?

       

      Thanks again,

       

       

      • AdamN's avatar
        AdamN
        Khoros Oracle
        12 years ago

        To get a setting value for a lower-level node such as a category, you'll want to use the REST API. If you're getting a permission denied error, try using the restadmin context object instead of the rest context object. That's the point I'd suggest being careful about. If you're just using a hard-coded REST API path, there shouldn't be any risk assuming you're ok with exposing the content of that setting for everyone. I'd discourage the use of user input to construct the path when using the restadmin context object (ie. query string parameter).