Using web services
Note: You are currently viewing documentation for Moodle 3.4. Up-to-date documentation for the latest stable version of Moodle is likely available here: Using web services.
This document explains how an administrator can set up a web service for users to access a service. Each user will have a specific and unique security key (also known as a "token") to access the service.
Enabling web services
- Access Settings > Site administration > Advanced features
- Check 'Enable web services' then click 'Save Changes'
Note: For security reasons, web services should only be enabled if you intend to make use of it.
Usually external applications that users wish to use dictate which protocols should be enabled.
- Access Settings > Site administration > Plugins > Web services > Manage protocols
- Enable the protocols (SOAP, REST, XMLRPC, AMF, ...) as required
Enabling web service function documentation
Enabling web service function documentation (also on the Manage protocols page) results in user-specific web service documentation being available for each user on their security keys page. This option is mainly useful to web service client developers. If nobody is creating a web service client, there is no need to enable this feature.
Creating a service
If none of the pre-build web services match your needs, you can create a custom service i.e. select which of the standard web service functions are available via that service.
You can enable only the specific functions that you need to expose, so not compromising on security.
- Access Settings > Site administration > Plugins > Web services > External services
- Click Add new custom service
- 'Authorised users only' - If enabled, you will need to select the authorised users manually. Otherwise all users with appropriate permissions are allowed
- 'Required capability' - If enabled, any user accessing the web service will be checked against this selected capability. (This is just an additional optional security layer.)
- Enter a name and check Enabled
- Click the button 'Add service'
Adding functions to the serviceCreating a web service client.
- Click 'Add functions' link
- Select 'create group' function and click the 'Add functions' button
You will then be returned to the service functions list. Opposite each function is a 'Required capabilities' field. Users need these capabilities to run each function. However there are exceptions - see the web service function documentation for details.
The final step is to grant appropriate permissions. The following capabilities should be allowed:
- moodle/webservice:createtoken - for allowing users to generate a security key
- webservice/rest:use, webservice/soap:use, webservice/xmlrpc:use, webservice/amf:use which match the enabled protocols.
- The required capabilities for the web service functions. These required capabilities are listed when you add a function to the service.
Once done, the web service should be set up. Users can obtain a personal security key and copy it in an external application.
Authorise only specific users
- Settings > Site Administration > Plugins > Web services > External Services
- Select Authorised users link (the service must have been set as Authorised users only in the Edit link)
- Select the created user and click Add
As you can see in the second screen capture, Moodle indicates if some capabilities need to be assigned to an authorised user. Moreover if you click on the authorised user you can setup some specific options: IP restriction and Valid until.
Create a token
This feature allows you to create a token for specific user. It can be useful if a user doesn't have the moodle/create:token capability. This is also the only way to create a token for an administrator. For security reason, tokens are not automatically generated in the administrator security keys page.
- Settings > Site Administration > Plugins > Web services > Manage tokens
- Click on Add
- Select the created user and service
- Click on Saves changes
Enable capabilities for the user
The last step, and the trickiest, is to grant the right permission to the external system user. It would need the following capabilities:
- "webservice/rest:use, webservice/soap:use, webservice/xmlrpc:use, webservice/amf:use" matching the enabled protocols.
- the required capabilities by the web service functions. These required capabilities are listed when you add a function to the service.
As you previously created a token for the external system user, you do not need to assign "moodle/webservice:createtoken" to it. For more information about roles and capabilities, read the Manage roles documentation.