Yes - All my REST interfaces start with a role verification test and appropriate exception.  Its a pain.

I completely agree. 

In my opinion integrations are interfaces and should have interface-authorization with roles.

Hi Fernando, yes indeed

For me the answer is no.

When I look at api-security there are two parts:

• identification & authentication: covered by basic authenctication (choose basic on the api) or by any other solution, like token-authentication (choose Custom on the api). possibly in combination with a login into Outsystems.
• authorization (or access management): can be covered by roles of the (at the previous point determined) user. In my opinion the role would be on the api-method. 

Hi Eric,

The idea described by Daniël Kuhlmann is regarding OutSystems REST consumption, meaning that OutSystems is calling external systems, therefore the authentication in the external systems is defined by the external system and which OutSystems need to follow. 

So Daniël Kuhlmann point was to validate user Role when the API is being called by a user Action, for example, Save Accounts, which triggers a salesforce call, this call would only be made if the user has the required Role.

Let me know if you have a different experience.

I'm with Eric on this one.  

Just like a screen is not bothered with AUTHENTICATION (we are already logged-in) and can allow access based on ROLE, calling an API (either consuming or hosting), requires AUTHORIZATION that the specific caller (by ROLE) is allowed to use the method which is independent of authentication.

So, perhaps all my users can access an API having a valid, registered user-name and password for Basic Authentication, but only a Manager may be able to access one particular API by virtue of his role.

To be able to simply tick a ROLE checkbox on the API, I don't have to add such checks in code.

In fairness, its not that big a deal to do, but we could have said the same for screens then.

Hi Lester is that not just what my idea is about ?

Hi All,

Just to make sure we are all in the same page Daniel Idea was to have the ability to set up for each REST consume API method which are the Roles allowed to make the call. The roles would show-up on the properties pane similar to web screens.

If this is the case, wouldn't that same logic applies to Server Actions, Client Actions, Service Actions and SOAP consume Actions?

Thanks,