VuFind APIs - A practical approach Ere Maijala VuFind Summit 2016

”APIs are great, can we add them?” ”Like, for what?” Types of APIs Backend Front-end Interactive Generic What’s common A request comes in The request is processed There’s a predefined structured outcome ”Like, when you enter a URL in the browser, you get some HTML?” ”No, see, structured.”

Shibboleth Single Logout ”Users’ sessions don’t end properly in the Identity Provider, do something!” Backend API Between Shibboleth Service Provider and VuFind When Shibboleth logout is processed, an API in VuFind is called to signal that the session must be terminated On login, the Shibboleth session id is stored in VuFind database mapped to VuFind session id On logout, this mapping is used to terminate the VuFind session Shibboleth chains the logout requests so that they propagate to all services Already available in vufind-org/master https://vufind.org/wiki/configuration:shibboleth

External Authentication - EZproxy ”So we moved from MetaLib to Finna [VuFind] and you still expect us to send users to MetaLib for EZproxy authorization?” Interactive API EZproxy redirects user to VuFind upon login VuFind prompts the user to log in (if not already) If the user is authorized, VuFind redirects back to EZproxy with a ticket Ticket is a hash from a shared secret and other details If authorization fails, user is informed in VuFind Already available in vufind-org/master https://vufind.org/wiki/configuration:ezproxy

Search API ”We are creating Cool Service X and we would like to access your search index” A generic API Work in progress Based on a practical approach (read: do something really quickly and try to make it nice later) Oops, a front-end service now becomes a backend others depend on

Search API Goals Simple Easy to use with modern tools (JSON, CORS, Swagger specification) Parameters as similar as possible to the search functionality in the VuFind UI Extensible with local fields etc. Easy to extend with new functionality Take advantage of record drivers Support API versioning from get-go Use permissions

Search API Development Steps First proof of concept: extend search results view=rss with view=json Test it out Move it to a separate controller Create documentation Publish the API with VuFind 2 (Feb 2016) Gather feedback and improve on it Most feedback has been about the content and index features, not the API implementation Contribute upstream: https://github.com/vufind-org/vufind/pull/819 Separate module for the API functionality Other awesome improvements in architecture thanks to Demian’s comments

Future API Development Possibilities Low-hanging fruits Read access to public lists Read access to record comments Other indexes like authorities Advanced search, maybe In the middle Token authorization with e.g. JWT (JSON Web Tokens) Holdings and new items from the ILS Possibly other read-only ILS APIs Rate limits Usage limits Content-type negotiation (if something else than JSON is needed) High above Read-write APIs

Search API Demo Our local production version at https://api.finna.fi/ Docs: https://www.kiwi.fi/pages/viewpage.action?pageId=53839221 Upstream version at [my computer]: http://localhost:8080/vufind2/api

Ere Maijala ere.maijala@helsinki.fi Not bad, huh? Ere Maijala ere.maijala@helsinki.fi