Requirements for REST API access

In order to gain access to the rest API, the following requirements must be met :
  1. At least one web sales listener enabled in the Director.
    • The web listener is the process that responds to the API request.
    • Web sales are not required to be enabled to the outside world - but if you do online tickets sales, you need to be aware that extensive use may require additional web listener processes.
  2. The person needing REST API access must be set up as an employee in the database - this means only specified employees can have access.
    • and have the checkbox REST API: enable access via url on the employee access tab
    • the employee does not neccessarily have to be able to log into Theatre Manager desktop, but they:
      • must have an employee record
      • must not be resigned
    • can have any user level from:
      • no access to normal access, or
      • you can set the user to API only which means they cannot log into TM but can use the REST api.
    • Permissions in the Employee Data tab to indicate which data can be accessed via the REST api.
  3. Have logged into the online web sales site and created an account, which requires:
    • at least one email address associated with their patron account (multiple emails for an employee are ok)
    • and a password that allows them log into the web store
  4. A workstation, browser, or toolset that is capable of connecting using TLS 1.2 or later for security. If you can't connect, try latest firefox, chrome and/or on windows 10 or some smart phone.
  5. (optional) Consider requiring complex passwords via a setting in system preferences. online - which will also affect your regular patrons as well.

    		Note: At this time, the web store password is probably different than the employee's Theatre Manager login account since they can set it themselves online.

    We recommend informing staff who are given access to the REST API to use complex passwords (or if you wish, make it mandatory). Since most people will not the API enabled for their employee account, they would be largely unaffected.

Diataxis: 
Explanation