API-Documentation accessing "live data"

[Wolfgang Orth]

Hello Bruce,

I am not sure whether I understood you correctly during the ClarionLive-Webinar.

You say that the Demo-option in the API-documention works with actual data?

That means, that if I deploy my software and grant access to colleagues at that site to investigate the API-documentation for interfacing their own programs with my data, they actually work with live-data?

That would be bad!

I better deploy a second installment with demo-data for documentation and lock the access to the API-docs in the actual installation with the  live-data. That would be okay, but I guess a big red warning should be added for us, so that we do not make any mistakes inadvertently.

Nonetheless, the API-documention has become even better by now, I really LOVE it! (As loing as I know the pitfalls....)

Thanks
Wolfgang

[Bruce]

Hi Wolfgang,

>> You say that the Demo-option in the API-documention works with actual data?

It works on whatever data you have given your colleagues access to. Assuming your API requires a login and password it requires those.

In other words the access they have in the API Documentation requires the same authentication as their program will have to use, and interacts on the same database as their program (with the same credentials) will access on.

>> That means, that if I deploy my software and grant access to colleagues at that site to investigate the API-documentation for interfacing their own programs with my data, they actually work with live-data?

If you give them credentials for live data then they'll be working on live data. If you give them credentials for demo data then they'll be working on demo data. You decide. (Of course their program will need credentials to real data, which means then they can use those credentials on the documentation page.)

>> I better deploy a second installment with demo-data for documentation and lock the access to the API-docs in the actual installation with the  live-data.

I'm not sure I understand your reasoning here. What can they do with the documentation that they can't do from their program (or CURL, or Postman) with live credentials?

Cheers
Bruce



That would be bad!