WSO2 API Manager: API Controller — How a user other than who has an admin role can import/export APIs? Part 2
By: Wasura Wattearachchi
Tags: API, Api Management, Import Export, Wso2, Wso2 Api Manager

WSO2 API Manager: API Controller — How a user other than who has an admin role can import/export APIs? Part 2 Wasura Wattearachchi Follow Apr 15 · 5 min read

In the previous article, we discussed the permissions a normal user (who does not have the admin role) should have in order to import and export APIs from WSO2 API Manager using the API Controller (apictl).

Generally, it can be stated that a user with a custom role with both API Create and API Publish permissions is allowed to import/export APIs. But this article will explore it furthermore by finding answers to the question “What happens if a user has only either API Create role or API Publish role, not both?”.

This question will be further divided into two questions as follows.

What happens if the user has only API Create permission? What happens if the user has only API Publish permission?

Prerequisites

Understanding about what we have discussed in the previous article.

Question 1 — What happens if the user has only API Create permission?

First by following steps 1 and 2 of the previous article, create a user who only has the API Create role. (Or else you can edit the permissions of the “custom_role” previously created to have only the API Create permission.)

Now as explained in the previous article, you need to create an API using apictl. (Refer here for more information). Note that, the initiated API will have the state CREATED in here (Inspect “Petstore/Meta-information/api.yaml” file to check the state).

apictl init Petstore --oas https://petstore.swagger.io/v2/swagger.json

Creating Petstore API

Now login to the dev environment as the “custom_user” as shown below.

Login to dev environment

Execute the below command to import the Petstore API to the dev environment.

apictl import-api --file ./Petstore --environment dev -k --preserve-provider=false

Import the API to dev environment with preserve-provider=false

Login to the publisher portal of the particular environment as admin and check whether the API is there.

Login to the publisher portal of dev environment

Delete the API from the publisher portal. Now open the “Petstore/Meta-information/api.yaml” file and change the state to PUBLISHED and re-import it.

Now open the “Petstore/Meta-information/api.yaml” file and change the state to PUBLISHED and re-import it. It will get imported successfully.

api.yaml file

In here an error message will be displayed as below.

Error message when importing the API with the state CREATED

But if you check the publisher portal, the API has been imported. But look at the state, it is not PUBLISHED as we changed. It has the state “CREATED”.

The API has been imported in CREATED state

This leads to the observation that,

If the custom_role ONLY has the API Create permission, then even though the user imports an API with PUBLISHED state it will be imported as an API in CREATED state.

Try exporting the API as well.

Irrespective of the API state the user can export the API successfully.

Question 2 — What happens if the user has only API Publish permission?

First by following steps 1 and 2 of the previous article, create a user who only has the API Publish role. (Or else you can edit the permissions of the “custom_role” previously created to have only the API Publish permission.)

Execute the below command to import the Petstore API to the dev environment.

apictl import-api --file ./Petstore --environment dev -k --preserve-provider=false

Error message when importing the API

If you login to the publisher portal and check whether the API is there, it will not be there. Change the state of the API in “Petstore/Meta-information/api.yaml” and check re-importing it. No matter what, you will not be able to import the API. This leads to the observation that,

A user that has the custom_role with ONLY API Publish permission cannot import an API.

Try exporting an API as well.

Irrespective of the API state the user can export the API successfully.

Conclusion

This article found the answers to the question, “What happens if a user has only either API Create role or API Publish role, not both?”. Two sub-questions under this question were discussed which have led to the below conclusions.

If the custom_role ONLY has the API Create permission, then even though the user imports an API with PUBLISHED state it will be imported as an API in CREATED state.

ONLY has the permission, then even though the user imports an API with PUBLISHED state it will be imported as an API in CREATED state. A user that has the custom_role with ONLY API Publish permission cannot import an API.

with ONLY permission cannot import an API. User can export an API whether he/she had only API Create or API Publish or both. (Even without having API Create or API Publish , the user can export an API)

References