Forum Discussion

b_poplin's avatar
b_poplin
Expert
12 years ago
Solved

User-level API access to custom content

I can access custom content through API using an Admin role, but I get 303 permission denied with user-level role. API example: [server]/restapi/vc/categories/id/[categoryId]/settings/name/customcont...
  • AdamN's avatar
    AdamN
    12 years ago

    To get a setting value for a lower-level node such as a category, you'll want to use the REST API. If you're getting a permission denied error, try using the restadmin context object instead of the rest context object. That's the point I'd suggest being careful about. If you're just using a hard-coded REST API path, there shouldn't be any risk assuming you're ok with exposing the content of that setting for everyone. I'd discourage the use of user input to construct the path when using the restadmin context object (ie. query string parameter).

AdamN's avatar
AdamN
Khoros Oracle
12 years ago

Unfortunately, I'm not sure there's going to be a good way to do this purely through the REST API. Although users can see the custom content in the UI, generally speaking users are not allowed to access the behind-the-scenes settings. To grant normal users the ability to see those settings through the REST API, you'd likely have to give them more permissions than desired (ie. the ability to edit/manage the node).

 

What I would suggest instead is using a custom endpoint. Normally I'd urge caution about exposing settings through a custom endpoint, but if you're just displaying the custom content values then there probably isn't too much concern. Within your custom endpoint, you'd want to make a REST API call to grab the value of the custom content, and then you could output that in the endpoint.

 

If you're not familiar with custom endpoints, you can learn more here:

http://lithosphere.lithium.com/t5/developers-knowledge-base/Working-with-Lithium-Studio-Endpoints/ta-p/60240

  • b_poplin's avatar
    b_poplin
    Expert
    12 years ago

    ENDPOINTS looks like it could be the right solution, but I need some more advice.

     

    What I am trying to do:

    I am trying to access a custom content setting on a category.

     

    Try1: Fail (contentKey is custom content field name)

    <#assign cc = settings.name.get('${contentKey}')/>

     

    cc always returns custom content from Community level. 

     

    Try2: Use rest call in Endpoint, same problem "permission denied" as using full external rest call.

     

    Any idea how to get "settings.name.get('[customSetting]') to return a specific category level value?

     

    Thanks again,

     

     

    • AdamN's avatar
      AdamN
      Khoros Oracle
      12 years ago

      To get a setting value for a lower-level node such as a category, you'll want to use the REST API. If you're getting a permission denied error, try using the restadmin context object instead of the rest context object. That's the point I'd suggest being careful about. If you're just using a hard-coded REST API path, there shouldn't be any risk assuming you're ok with exposing the content of that setting for everyone. I'd discourage the use of user input to construct the path when using the restadmin context object (ie. query string parameter).