search

open311 / open311.github.io

Open311 Specs and Wiki
http://wiki.open311.org
32 stars 41 forks source link

Clarify whether the server can require API keys for different resources #33

Open philipashlock opened 11 years ago

philipashlock commented 11 years ago

Currently, the spec states that API keys are only required for the POST Service Request method, but it doesn't clearly say whether this is optional for other methods. It says that API keys are not required for other methods, but if an implementation wanted to require them for other methods, would this be acceptable or would it break compliance with the spec? This needs to be explained in the documentation.

http://lists.open311.org/r/post/5X71Jj9HSG1gOX8worgppv

antony-lovric commented 7 years ago

Has anyone else thought about this? We would like to use the API key to throttle traffic and have insight into who is using the system. Without it we would need to use quotas against IPs or an alternate mitigation strategy.