|
1 | 1 | # OpenSPP API
|
2 | 2 |
|
3 |
| -## Overview |
4 |
| - |
5 |
| -The [spp_api](spp_api) module provides a comprehensive framework for building and managing a RESTful API for the OpenSPP platform. It builds upon the foundation laid by the [spp_base_api](spp_base_api) module, adding crucial components for API definition, documentation, and security. |
| 3 | +The OpenSPP API module provides a robust framework for building and managing a RESTful API (Application Programming Interface) for the OpenSPP platform. It enables external systems and applications to securely interact with OpenSPP data and functionalities, facilitating seamless integration, data exchange, and automation. |
6 | 4 |
|
7 | 5 | ## Purpose
|
8 | 6 |
|
9 |
| -This module is designed to: |
| 7 | +This module serves as the central hub for OpenSPP's external communication, offering a structured way to expose and manage platform capabilities. It accomplishes the following key objectives: |
| 8 | + |
| 9 | +* **Standardized Data Access:** Establishes a consistent and secure method for external applications to read, create, update, and delete OpenSPP data, such as beneficiary records or program details. |
| 10 | +* **Customizable API Endpoints:** Allows users to define specific API endpoints for various OpenSPP data models and operations, tailoring the API to the exact needs of integrated systems. |
| 11 | +* **Enhanced Security:** Implements authentication and authorization mechanisms to ensure that only authorized users and systems can access and manipulate sensitive program information. |
| 12 | +* **Comprehensive Logging and Auditing:** Provides detailed logging of all API interactions, offering transparency, aiding in troubleshooting, and supporting compliance requirements. |
| 13 | +* **Flexible Data Mapping:** Enables the renaming and configuration of data fields exposed through the API, making integration simpler and more intuitive for external systems. |
| 14 | + |
| 15 | +## Dependencies and Integration |
| 16 | + |
| 17 | +The `spp_api` module is foundational to OpenSPP's external connectivity, building upon other core modules to deliver its capabilities: |
| 18 | + |
| 19 | +* It leverages the [OpenSPP Base API](spp_base_api) module, which provides essential, low-level API functions and methods for interacting with OpenSPP models. This ensures a consistent foundation for all API operations. |
| 20 | +* Security for API access is handled by the [OpenSPP API: Oauth](spp_oauth) module, which implements secure authentication protocols and token management. This module ensures that all API requests are properly authorized before accessing OpenSPP resources. |
| 21 | +* The module integrates with the core `mail` module, likely for sending notifications or alerts related to API activities or issues. |
| 22 | +* It utilizes the `web` module for exposing API endpoints over the web, making them accessible to external applications. |
10 | 23 |
|
11 |
| -- **Define API Endpoints:** Create, configure, and manage API endpoints for accessing and manipulating data within the OpenSPP system. |
12 |
| -- **Generate API Documentation:** Automatically generate OpenAPI (Swagger) documentation for all defined API endpoints, providing a clear and interactive interface for developers. |
13 |
| -- **Enforce API Security:** Integrate with the [spp_oauth](spp_oauth) module to handle authentication and authorization for API requests, ensuring secure access to sensitive data. |
14 |
| -- **Log API Interactions:** Record details of all incoming API requests and outgoing responses, facilitating debugging, monitoring, and auditing. |
| 24 | +Together, these integrations allow `spp_api` to provide a secure, functional, and extensible API layer for the entire OpenSPP platform. |
15 | 25 |
|
16 |
| -## Dependencies |
| 26 | +## Additional Functionality |
17 | 27 |
|
18 |
| -- **[spp_base_api](spp_base_api):** This module relies on [spp_base_api](spp_base_api) for its core API interaction functions and methods. |
19 |
| -- **web:** Leverages Odoo's web framework for routing and handling HTTP requests. |
20 |
| -- **[spp_oauth](spp_oauth):** Integrates with the [spp_oauth](spp_oauth) module to implement OAuth 2.0-based authentication and authorization for securing API access. |
| 28 | +The `spp_api` module offers a range of features to configure and manage API interactions effectively. |
21 | 29 |
|
22 |
| -## Functionality and Integration |
| 30 | +### API Namespace and Endpoint Configuration |
23 | 31 |
|
24 |
| -The [spp_api](spp_api) module introduces key components for building a robust API: |
| 32 | +Users can define distinct API namespaces to group related endpoints, manage versions, and control access. Each namespace acts as a unique integration point, such as 'Beneficiary_Service_v1' or 'Financial_Aid_v2'. Within these namespaces, specific API paths (endpoints) are created for individual OpenSPP data models (e.g., "Beneficiary", "Program"). For each path, users configure: |
25 | 33 |
|
26 |
| -**1. API Namespaces and Paths:** |
| 34 | +* **Supported Operations:** Define whether external systems can read (GET), create (POST), update (PUT), delete (DELETE), or perform custom (PATCH) actions on the data. |
| 35 | +* **Data Filtering and Limits:** For read operations, specify default filters (e.g., only active beneficiaries) and set limits on the number of records returned. |
| 36 | +* **Custom Functions:** Implement custom business logic as API endpoints, complete with defined input parameters. |
27 | 37 |
|
28 |
| -- **Namespaces:** Represent logical groupings of API endpoints, often associated with specific functionalities or versions (e.g., `v1`, `v2`). |
29 |
| -- **Paths:** Define individual API endpoints within a namespace, specifying the HTTP method (GET, POST, PUT, DELETE, PATCH), URL path, data model, fields to expose, and any filtering or domain logic. |
| 38 | +### Data Field Customization |
30 | 39 |
|
31 |
| -**2. API Documentation:** |
| 40 | +To simplify integration, the module allows granular control over how data fields appear in the API: |
32 | 41 |
|
33 |
| -- **OpenAPI (Swagger) Generation:** The module automatically generates OpenAPI documentation based on the defined namespaces and paths. This documentation serves as a comprehensive guide for developers, detailing available endpoints, request/response formats, and authentication requirements. |
| 42 | +* **Field Selection:** For read operations, specify exactly which fields of an OpenSPP model are exposed, preventing unnecessary data transfer. |
| 43 | +* **Required Fields and Default Values:** For create and update operations, mark specific fields as mandatory or provide default values, ensuring data consistency. |
| 44 | +* **Field Aliases:** Rename internal OpenSPP field names to more intuitive, external-facing names within the API. For instance, an internal field like `b_dob` (beneficiary date of birth) can be aliased to `beneficiary_birthdate` for clarity in the API. These aliases can be global or specific to an API path. |
34 | 45 |
|
35 |
| -**3. API Security:** |
| 46 | +### API Security and Logging |
36 | 47 |
|
37 |
| -- **OAuth 2.0 Integration:** Seamlessly integrates with [spp_oauth](spp_oauth) to enforce authentication and authorization using OAuth 2.0 standards. API requests must include valid access tokens, obtained through the OAuth 2.0 flow. |
| 48 | +The module provides essential tools for securing and monitoring API usage: |
38 | 49 |
|
39 |
| -**4. API Logging:** |
| 50 | +* **User API Tokens:** OpenSPP users can generate unique API tokens to authenticate their external applications. These tokens are essential for secure access to the API. |
| 51 | +* **Namespace-based Access Control:** Assign specific API namespaces to individual OpenSPP users, granting them access only to the integrations they need. |
| 52 | +* **Detailed API Logs:** All API requests and responses are logged, including method, model, and the data exchanged. This provides a comprehensive audit trail, crucial for debugging, security monitoring, and compliance. Users can configure logging levels (disabled, short, full) for both requests and responses. |
40 | 53 |
|
41 |
| -- **Detailed Logs:** Records comprehensive logs for all API interactions, including the request method, URL, parameters, data, response status code, and response data. |
42 |
| -- **Configurable Logging Levels:** Allows administrators to configure the level of detail logged for requests and responses (e.g., disabled, short, full debug). |
| 54 | +### Advanced API Operations |
43 | 55 |
|
44 |
| -**5. Integration with Other Modules:** |
| 56 | +Beyond standard CRUD (Create, Read, Update, Delete) operations, the module supports custom API functions: |
45 | 57 |
|
46 |
| -- Any OpenSPP module that wants to expose data or functionalities through an API can leverage the [spp_api](spp_api) module. |
47 |
| -- Modules define their API endpoints using namespaces and paths, ensuring consistency and automatic documentation generation. |
48 |
| -- The [spp_api](spp_api) module handles routing, authentication, and logging for these endpoints, simplifying development and ensuring API security. |
| 58 | +* **Custom Function Parameters:** Define specific parameters (e.g., name, type, required status, default value) for custom API functions, allowing external systems to trigger complex business processes within OpenSPP. |
| 59 | +* **Record-Specific Actions:** Custom functions can be configured to apply either globally or on specific records, offering flexibility for targeted actions. |
49 | 60 |
|
50 | 61 | ## Conclusion
|
51 | 62 |
|
52 |
| -The [spp_api](spp_api) module is the cornerstone for building and managing a secure and well-documented RESTful API for the OpenSPP platform. It provides a standardized framework for API development, streamlines integration with other modules, and enhances the security of OpenSPP data by leveraging OAuth 2.0 authentication. |
| 63 | +The `spp_api` module is indispensable for extending OpenSPP's reach, enabling secure, flexible, and auditable integration with external systems to streamline social protection program management and data exchange. |
0 commit comments