Developer forum

Hi Adrian,

Wouldn't you use the Management API for that?

I guess on the delivery API the problem may also be on how to validate if the user has permissions to update the user. So if you build your custom endpoint that internally you do the necessary validation (for that project) and handle that update (through the management API or regular API methods), that would probably be easier.

Best Regards,

Nuno

Hi Nuno,

In the first case, I would like to use the endpoint to receive data from ERP.
But I also consider some integration with a Mobile App where I would not be able to use the Management API since the editing will happen from the "Customer center".

Thank you,
Adrian

Hi Adrian,

I understand the use case. I guess my concern is security / exploit scenarios.

• If there's a webapi endpoint that can update "any user" that's bad. 
  • I know this isn't exactly what you're asking for but my token, shouldn't allow editing other users
• So there needs to be some place that allows User 123 (i.e. Nuno) to update User 456 (i.e. Adrian)
  • The backend has a better way to manage that
  • Moving that "logic" to a webapi is what could be hard
  • Which is why probably a custom webapi of your own, that hold that mapping and logic, may be a better path

But I can't speak for the Core platform team. Maybe they have other thoughts and ideas :P 

Nuno

Hi Nuno,

Thank you very much. I completely agree with you.
We are considering a custom webapi but I would try to avoid it if we can handle it with standard/existing functionality.

Waiting for the Core team though :)

Thank you,
Adrian

Hi Both

The latest updates to DW10 allows for managing users and addresses across e.g. an "account" - based on customer number. Those features are also (some still in progress) able to be handled by the management API. The new user modules are also getting more natively build features for an account admin to create users. These features will also be supported at the dwapi endpoints as we go along.

As Nuno mentions, the security is the big thing here - creating and updating users would have to happen in a context of another user that has permissions to do that.

Management API gives you full access to creating anything.

We are also considering a "Service API" that is an api key based api that is between the delivery api (dwapi) and the management API. E.g. for getting and creating users with admin permssions, udating products, inventory, prices etc - for more integration related tasks like this one. But it is still not a plan...

This just to give you insights to what we are working on.