@@ -16,7 +16,7 @@ REST API for Roundup
16
16
:depth: 3
17
17
18
18
Introduction
19
- ------------
19
+ ============
20
20
21
21
After the last 1.6.0 Release, a REST-API developed in 2015 during a
22
22
Google Summer of Code (GSOC) by Chau Nguyen, supervised by Ezio
@@ -26,7 +26,7 @@ functions for a single page web application, e.g. etag support,
26
26
pagination, field embedding among others.
27
27
28
28
Enabling the REST API
29
- ---------------------
29
+ =====================
30
30
31
31
The REST API can be disabled in the ``[web]`` section of ``config.ini``
32
32
via the variable ``enable_rest`` which is ``yes`` by default.
@@ -66,7 +66,7 @@ explicitly set.)
66
66
.. _upgrading directions: upgrading.html
67
67
68
68
Preventing CSRF Attacks
69
- =======================
69
+ -----------------------
70
70
71
71
Clients should set the header X-REQUESTED-WITH to any value and the
72
72
tracker's config.ini should have ``csrf_enforce_header_x-requested-with
@@ -78,7 +78,7 @@ the origin using the ``allowed_api_origins`` setting in
78
78
``config.ini``.
79
79
80
80
Rate Limiting the API
81
- =====================
81
+ ---------------------
82
82
83
83
This is a work in progress. This version of roundup includes Rate
84
84
Limiting for the API (which is different from rate limiting login
@@ -114,15 +114,15 @@ possible for it to miscount allowing more than burst count. Errors of
114
114
up to 10% have been seen on slower hardware.
115
115
116
116
Client API
117
- ----------
117
+ ==========
118
118
119
119
The top-level REST url ``/rest/`` will display the current version of
120
120
the REST API (Version 1 as of this writing) and some links to relevant
121
121
endpoints of the API. In the following the ``/rest`` prefix is omitted
122
122
from relative REST-API links for brevity.
123
123
124
124
Headers
125
- =======
125
+ -------
126
126
127
127
If rate limiting is enabled there are 3 "standard" headers:
128
128
@@ -153,7 +153,7 @@ If the client has requested a deprecated API endpoint, the header:
153
153
the sunset link type.
154
154
155
155
Hyperdb Stats
156
- =============
156
+ -------------
157
157
158
158
Adding ``@stats=true`` as a GET query parameter or POST data item will
159
159
augment the response with an ``@stats`` dictionary. Any value other
@@ -180,7 +180,7 @@ understanding of the code is recommended if you are going to use this
180
180
info.
181
181
182
182
Versioning
183
- ==========
183
+ ----------
184
184
185
185
Currently there is only one version of the API. Versions are simple
186
186
integers. The current version is ``1``. Version selection is
@@ -199,7 +199,7 @@ The server default is reported by querying the ``/rest/`` endpoint as
199
199
described above.
200
200
201
201
Input Formats
202
- =============
202
+ -------------
203
203
204
204
For a GET or OPTIONS request, the Content-Type header should
205
205
not be sent.
@@ -209,7 +209,7 @@ Otherwise Content-Type is allowed to be ``application/json`` or
209
209
code 415.
210
210
211
211
CORS preflight requests
212
- ^^^^^^^^^^^^^^^^^^^^^^^
212
+ ~~~~~~~~~~~~~~~~~~~~~~~
213
213
214
214
CORS preflight requests are done using the OPTIONS method. They
215
215
require that REST be enabled. These requests do not make any changes
@@ -263,7 +263,7 @@ cause a problem. If it is an issue, you can see
263
263
and craft a rate limiter that ignores anonymous OPTIONS requests.
264
264
265
265
Response Formats
266
- ================
266
+ ----------------
267
267
268
268
The default response format is json.
269
269
@@ -300,7 +300,7 @@ the accept header are available or if the accept header is invalid.
300
300
301
301
302
302
General Guidelines
303
- ==================
303
+ ------------------
304
304
305
305
Performing a ``GET`` on an item or property of an item will return an
306
306
ETag header or an @etag property. This needs to be submitted with
@@ -405,21 +405,21 @@ properties). Example::
405
405
406
406
407
407
Special Endpoints
408
- =================
408
+ -----------------
409
409
410
410
There are a few special endpoints that provide some additional data.
411
411
Tracker administrators can add new endpoints. See
412
412
"Programming the REST API"_ below.
413
413
414
414
/summary
415
- ^^^^^^^^
415
+ ~~~~~~~~
416
416
417
417
A Summary page can be reached via ``/summary`` via the ``GET`` method.
418
418
This is currently hard-coded for the standard tracker schema shipped
419
419
with roundup and will display a summary of open issues.
420
420
421
421
/data
422
- ^^^^^
422
+ ~~~~~
423
423
424
424
This is the primary entry point for data from the tracker.
425
425
@@ -439,7 +439,7 @@ dictionary with the entry ``data`` referring to the returned data.
439
439
Details are in the sections below.
440
440
441
441
/data/\ *class* Collection
442
- ==========================
442
+ --------------------------
443
443
444
444
When performing the ``GET`` method on a class (e.g. ``/data/issue``),
445
445
the ``data`` object includes the number of items available in
@@ -474,7 +474,7 @@ decorations in the response. See the section on pagination below for
474
474
details.
475
475
476
476
Searching
477
- ^^^^^^^^^
477
+ ~~~~~~~~~
478
478
479
479
Searching is done by adding roundup field names and values as query
480
480
parameters. Using: https://.../rest/data/issue you can search using:
@@ -549,7 +549,7 @@ body of a msg) is a work in progress.
549
549
.. _URL Encoding: https://en.wikipedia.org/wiki/Percent-encoding
550
550
551
551
Transitive Searching
552
- ~~~~~~~~~~~~~~~~~~~~
552
+ ^^^^^^^^^^^^^^^^^^^^
553
553
554
554
In addition to searching an issue by its properties, you can search
555
555
for issues where linked items have a certain property. For example
@@ -572,7 +572,7 @@ it. However they may be able to use searches to discover the value of
572
572
the field even if they can't view it.
573
573
574
574
Sorting
575
- ^^^^^^^
575
+ ~~~~~~~
576
576
577
577
Collection endpoints support sorting. This is controlled by specifying a
578
578
``@sort`` parameter with a list of properties of the searched class.
@@ -586,7 +586,7 @@ and then by id of an issue::
586
586
587
587
588
588
Pagination
589
- ^^^^^^^^^^
589
+ ~~~~~~~~~~
590
590
591
591
Collection endpoints support pagination. This is controlled by query
592
592
parameters ``@page_size`` and ``@page_index`` (Note the use of the
@@ -645,7 +645,7 @@ clients must be prepared to handle the incomplete response and request
645
645
the next URL to retrieve all of the entries.
646
646
647
647
Field embedding and verbose output
648
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
648
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
649
649
650
650
In collections, you can specify what fields should be embedded in the
651
651
returned data. There are some shortcuts provided using the
@@ -738,7 +738,7 @@ See the `Searches and selection`_ section for the use cases supported
738
738
by these features.
739
739
740
740
Getting Message and Files Content
741
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
741
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
742
742
743
743
You can retreive a message with a url like
744
744
``https://.../demo/rest/data/msg/11``. This returns something like::
@@ -850,7 +850,7 @@ You can use the `binary_content property`_ described below to
850
850
retrieve an encoded copy of the data.
851
851
852
852
Other query params
853
- ^^^^^^^^^^^^^^^^^^
853
+ ~~~~~~~~~~~~~~~~~~
854
854
855
855
This table lists other supported parameters:
856
856
@@ -869,7 +869,7 @@ This table lists other supported parameters:
869
869
this time.
870
870
871
871
Using the POST method
872
- ^^^^^^^^^^^^^^^^^^^^^
872
+ ~~~~~~~~~~~~~~~~~~~~~
873
873
874
874
Only class links support the ``POST`` method for creation of new items
875
875
of a class, e.g., a new issue via the ``/data/issue`` link. The post
@@ -992,15 +992,15 @@ mechanism.
992
992
response was lost.
993
993
994
994
Other Supported Methods for Collections
995
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
995
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
996
996
997
997
Supports the ``OPTIONS`` method for determining which methods are
998
998
allowed on a given endpoint.
999
999
1000
1000
Does not support PUT, DELETE or PATCH.
1001
1001
1002
1002
/data/\ *class*/\ *id* item
1003
- ===========================
1003
+ ---------------------------
1004
1004
1005
1005
When performing the ``GET`` method on an item
1006
1006
(e.g. ``/data/issue/42``), a ``link`` attribute contains the link to
@@ -1083,7 +1083,7 @@ An example of returned values::
1083
1083
}
1084
1084
1085
1085
Retrieve item using key value
1086
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1086
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1087
1087
1088
1088
If the class has a key attribute, e.g. the 'status' class in the
1089
1089
classic tracker, it can be used to retrieve the item.
@@ -1103,7 +1103,7 @@ The long-form (with ``=``) is different from a query-parameter like
1103
1103
that have ``closed`` as a substring.
1104
1104
1105
1105
Dealing with Messages and Files
1106
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1106
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1107
1107
1108
1108
Using the requests library you can upload a file using::
1109
1109
@@ -1147,7 +1147,7 @@ return something like::
1147
1147
1148
1148
1149
1149
Other Supported Methods for Items
1150
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1150
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1151
1151
1152
1152
The method ``PUT`` is allowed on individual items, e.g.
1153
1153
``/data/issue/42`` On success it returns the same parameters as the
@@ -1302,7 +1302,7 @@ payload. When modifying a property via ``PUT`` or ``PATCH`` or
1302
1302
``If-Match`` header.
1303
1303
1304
1304
/data/\ *class*/\ *id*/\ *property* field
1305
- =========================================
1305
+ -----------------------------------------
1306
1306
1307
1307
A ``GET`` method on a property (e.g. ``/data/issue/42/title``) returns the
1308
1308
link, an ``@etag``, the type of the property (e.g. "<type str>") the id
@@ -1325,7 +1325,7 @@ All endpoints support an ``OPTIONS`` method for determining which
1325
1325
methods are allowed on a given endpoint.
1326
1326
1327
1327
Message and File Content
1328
- ^^^^^^^^^^^^^^^^^^^^^^^^
1328
+ ~~~~~~~~~~~~~~~~~~~~~~~~
1329
1329
1330
1330
Messages and files have content properties. If the data is utf-8
1331
1331
compatible (e.g. an email message) you can retrieve it with
@@ -1369,7 +1369,7 @@ The data is a json encoded hexidecimal representation of the data.
1369
1369
1370
1370
1371
1371
Other Supported Methods for fields
1372
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1372
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1373
1373
1374
1374
The method ``PUT`` is allowed on a property e.g.,
1375
1375
``/data/issue/42/title``. On success it returns the same parameters as
@@ -1421,7 +1421,7 @@ payload. When modifying a property via ``PUT`` or ``PATCH`` or
1421
1421
``If-Match`` header.
1422
1422
1423
1423
Tunneling Methods via POST
1424
- ==========================
1424
+ --------------------------
1425
1425
1426
1426
If you are working through a proxy and unable to use http methods like
1427
1427
PUT, PATCH, or DELETE, you can use POST to perform the action. To tunnel
@@ -1431,10 +1431,10 @@ POST should be what you would send if you were using the method
1431
1431
without tunneling.
1432
1432
1433
1433
Examples and Use Cases
1434
- ----------------------
1434
+ ======================
1435
1435
1436
1436
sample python client
1437
- ====================
1437
+ --------------------
1438
1438
1439
1439
The client uses the python ``requests`` library for easier interaction
1440
1440
with a REST API supporting JSON encoding::
@@ -1516,7 +1516,7 @@ and restore::
1516
1516
1517
1517
1518
1518
Searches and selection
1519
- ======================
1519
+ ----------------------
1520
1520
1521
1521
One difficult interface issue is selection of items from a long list.
1522
1522
Using multi-item selects requires loading a lot of data (e.g. consider
@@ -1611,14 +1611,14 @@ fields can be used for subsearch and sorting.
1611
1611
1612
1612
1613
1613
Programming the REST API
1614
- ------------------------
1614
+ ========================
1615
1615
1616
1616
You can extend the rest api for a tracker. This describes how to add
1617
1617
new rest end points. At some point it will also describe the rest.py
1618
1618
structure and implementation.
1619
1619
1620
1620
Adding new rest endpoints
1621
- =========================
1621
+ -------------------------
1622
1622
1623
1623
Add or edit the file `interfaces.py`_ at the root of the tracker
1624
1624
directory.
@@ -1692,7 +1692,7 @@ Adding other endpoints (e.g. to allow an OPTIONS query against
1692
1692
``/data/issue/@schema``) is left as an exercise for the reader.
1693
1693
1694
1694
Redefine/move rest endpoints
1695
- ============================
1695
+ ----------------------------
1696
1696
1697
1697
In addition to adding new endpoints, you can redefine existing
1698
1698
endpoints. Adding this as described above::
@@ -1734,7 +1734,7 @@ normally at /rest/data/<class>.
1734
1734
1735
1735
1736
1736
Controlling Access to Backend Data
1737
- ==================================
1737
+ ----------------------------------
1738
1738
1739
1739
Roundup's schema is the primary access control mechanism. Roles and
1740
1740
Permissions provide the ability to carefully control what data can be
@@ -1846,7 +1846,7 @@ the url passes the ``roles=User`` filter option which is silently
1846
1846
ignored.
1847
1847
1848
1848
Changing Access Roles with JSON Web Tokens
1849
- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1849
+ ------------------------------------------
1850
1850
1851
1851
As discussed above Roundup's schema is the access control mechanism.
1852
1852
However you may want to integrate a third party system with roundup.
@@ -2110,7 +2110,7 @@ for ideas or add your own.
2110
2110
.. _thoughts on JWT credentials: https://issues.roundup-tracker.org/issue2551064
2111
2111
2112
2112
Final steps
2113
- ^^^^^^^^^^^
2113
+ ~~~~~~~~~~~
2114
2114
2115
2115
See the `upgrading directions`_ on how to use the ``updateconfig``
2116
2116
command to generate an updated copy of config.ini using
@@ -2133,7 +2133,7 @@ subscribing and for archives of the lists.
2133
2133
2134
2134
2135
2135
Creating Custom Rate Limits
2136
- ===========================
2136
+ ---------------------------
2137
2137
2138
2138
You can replace the default rate limiter that is configured using
2139
2139
the tracker's ``config.ini``. You can return different rate
@@ -2177,7 +2177,7 @@ and period that are specific to a user. If either is set to 0,
2177
2177
the defaults from ``config.ini`` file are used.
2178
2178
2179
2179
Test Examples
2180
- ^^^^^^^^^^^^^
2180
+ ~~~~~~~~~~~~~
2181
2181
2182
2182
Rate limit tests::
2183
2183
0 commit comments