Why is API endpoint /setup/company restricted?

Developing for Dolibarr
1

Forbidden: Error API open to admin users only or to the users with logins defined into constant API_LOGINS_ALLOWED_FOR_GET_COMPANY

Why? What is the rationale for keeping the information in API endpoint /setup/company restricted?

I only wanted to extract 3 key pieces of Company information:

  • name
  • email
  • url

such that I could automatically show it. I don’t see any sensitive information in the output of that API endpoint.

Are there any other API calls I can use to get the information?

2

Setting API_LOGINS_ALLOWED_FOR_GET_COMPANY=1 as a global variable also does not return a result. It does not generate that error, but it returns empty. :face_exhaling:

3

I set it to the usernames allowed to log in, or rather until now I set it to 1 username, but now I need 2 and I saw your message

4

it now seems like the name of this variable is misleading because it is named loginS, but only allowed to contain 1 login?

./htdocs/api/class/api_setup.class.php:

&& (!getDolGlobalString('API_LOGINS_ALLOWED_FOR_GET_COMPANY') || DolibarrApiAccess::$user->login != getDolGlobalString('API_LOGINS_ALLOWED_FOR_GET_COMPANY'))) {

This looks to me like just one user

$user->login != getDolGlobalString('API_LOGINS_ALLOWED_FOR_GET_COMPANY')