Our monthly Virtual Happy Hour is happening this week, Fri Feb 23!

Try our conversational search powered by Generative AI!

Mark Hall
Feb 13, 2015
(2 votes)

Important Updates to the ServiceApi

We have released a new version of the EPiServer.ServiceApi and I wanted to highlight some important features over the last two releases.  As of version 1.2.0 the ServiceApi is now split out into two packages.

  • EPiServer.ServiceApi - this is the base package that only has dependency to EPiServer.Cms.Core.  This package will allow you to import media as well as episerverdata files.
  • EpiServer.ServiceApi.Commerce - this is the commerce package that has a dependency to EPiServer.Commerce.Core.  This package adds functionality to import catalog content and some restful operations for workng with catalog content.

As of version 1.3.0 all actions require permissions.  This means the user getting an auth token must have access to the permissions to use the functions.  The permissions are done with the new permissions to functions introduced in EPiServer.Cms.Core 7.19.1.  The ServiceApi has two permissions read and write.  Any function that manipulates data will require write access while all other require read access.  By default when instaling version 1.3.0 the administrators role is granted read and write access. 

If you would like to use the ServiceApi read and write permissions in your own webapi controlllers, you can decorate your method like below.  You also have the ability to create your own permissions and use with the AuthorizePermission attribute.

[Route("myroute", Name = "mymethod")]
[EPiServer.ServiceApi.Configuration.AuthorizePermission(EPiServer.ServiceApi.Configuration.Permissions.GroupName, EPiServer.ServiceApi.Configuration.Permissions.Read)]
public virtual IHttpActionResult MyMethod()
        if (!ModelState.IsValid)
            return BadRequest(ModelState);
        return Ok(ModelFactory.GetMyMethod());

ServiceAPi automatically registers controllers with attribute routing so this allows you to use the permissions in your own webapi controllers.  We needed to add a new AuthorizePermission for webapi controllers, the one introduced in EPiServer.Web.Mvc is only for mvc controllers.

There were also some additional security updates which lead the removal of httpmodule EPiServer.ServiceApi.IntegrationAuthorizationModule.

Feb 13, 2015


Please login to comment.
Latest blogs
Roll Your Own Security Headers

Proper security headers are a must for your Optimizely driven website. There are a variety of tools out there that will help with this, but when...

Ethan Schofer | Feb 21, 2024

Migrate Catalog content properties

A colleague asked me yesterday – how do we migrate properties of catalog content. There is, unfortunately, no official way to do it. There are...

Quan Mai | Feb 20, 2024 | Syndicated blog

Adjust log levels in Optimizely DXP

You may adjust the log levels for your site in Optimizely DXP yourself, but only for the Integration environment. Follow this step-by-step guide.

Tomas Hensrud Gulla | Feb 20, 2024 | Syndicated blog

Introducing Search & Navigation Dashboard for Resource Usage

We're excited to unveil the latest addition to the Search & Navigation suite: a dashboard designed to proactively monitor your resource usage. It's...

Edvin Dackelid Johansson | Feb 20, 2024