Mark Hall
Feb 13, 2015
(2 votes)

Important Updates to the ServiceApi

We have released a new version of the EPiServer.ServiceApi and I wanted to highlight some important features over the last two releases.  As of version 1.2.0 the ServiceApi is now split out into two packages.

  • EPiServer.ServiceApi - this is the base package that only has dependency to EPiServer.Cms.Core.  This package will allow you to import media as well as episerverdata files.
  • EpiServer.ServiceApi.Commerce - this is the commerce package that has a dependency to EPiServer.Commerce.Core.  This package adds functionality to import catalog content and some restful operations for workng with catalog content.

As of version 1.3.0 all actions require permissions.  This means the user getting an auth token must have access to the permissions to use the functions.  The permissions are done with the new permissions to functions introduced in EPiServer.Cms.Core 7.19.1.  The ServiceApi has two permissions read and write.  Any function that manipulates data will require write access while all other require read access.  By default when instaling version 1.3.0 the administrators role is granted read and write access. 

If you would like to use the ServiceApi read and write permissions in your own webapi controlllers, you can decorate your method like below.  You also have the ability to create your own permissions and use with the AuthorizePermission attribute.

[Route("myroute", Name = "mymethod")]
[EPiServer.ServiceApi.Configuration.AuthorizePermission(EPiServer.ServiceApi.Configuration.Permissions.GroupName, EPiServer.ServiceApi.Configuration.Permissions.Read)]
public virtual IHttpActionResult MyMethod()
        if (!ModelState.IsValid)
            return BadRequest(ModelState);
        return Ok(ModelFactory.GetMyMethod());

ServiceAPi automatically registers controllers with attribute routing so this allows you to use the permissions in your own webapi controllers.  We needed to add a new AuthorizePermission for webapi controllers, the one introduced in EPiServer.Web.Mvc is only for mvc controllers.

There were also some additional security updates which lead the removal of httpmodule EPiServer.ServiceApi.IntegrationAuthorizationModule.

Feb 13, 2015


Please login to comment.
Latest blogs
Optimizely Search & Navigation - Get autocomplete suggestions in right language

When you are using Optimizely Search & Navigation (Find) to help you generate autocomplete suggestions server side in a multi-language scenario it...

Allan Thraen | Jun 5, 2023 | Syndicated blog

Easy property inheritance in Optimizely CMS

Ever needed a way to inherit property values down through the page hierarchy in Optimizely CMS 12? Now there is an easy way to enable that.

Allan Thraen | Jun 5, 2023 | Syndicated blog

Content Bulk Edit

Bulk Edit is a plugin that allows to make changes to more than one Content at the same time. This can save time by simultaneously updating multiple...

Grzegorz Wiecheć | Jun 5, 2023 | Syndicated blog

Caching & Rendering of metadata from the DAM

For the EPiServer.Cms.WelcomeIntegration.UI 1.2.0 release, we have facilitated the ability to cache and render metadata from assets within the DAM....

Matthew Slim | Jun 2, 2023