https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38745 --- Comment #8 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 209593 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209593&action=edit Bug 38745: Add the /rpc route and spec Add a JSON-RPC 2.0 endpoint, POST /api/v1/rpc, for actions that do not fit the REST model, such as bulk actions. It is described in the API spec, and reports every failure as a JSON-RPC error object: parse error, invalid request (batch requests and notifications are not supported), method not found and invalid params. Swagger 2.0 has no oneOf, which the spec validator rejects, so the params schema and the required permissions of each method live in an x-rpc-methods extension of the rpc_request definition, to be replaced by a oneOf when the spec is migrated to OpenAPI 3 (bug 35613). The route only requires the user to be authenticated, including patrons who cannot log in to the staff interface, so they can find out which method names exist and what permissions they need, as they can from the API spec. The permissions are checked per method. CSRF: cookie session authentication is accepted like on the other routes, and CSRF protection for the REST API comes with bug 34451. Until that is applied, callers of /rpc using a session cookie are not protected. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> -- You are receiving this mail because: You are watching all bug changes.