Mnet Web services API

Overview

The Web Services API provides Moodle with a web service interface to allow exchange of data and information with other systems.

For example,

1. Manage user data - send and retrieve the information,
2. Manage course enrolments - add/remove teachers and students,
3. Course management - create new courses based on templates,
4. Gradebook info - extract grades information from Moodle.

XML-RPC background

The XML-RPC service allows other servers to contact your Moodle server and request that it call a function. The Moodle server might do something, like create a user, or it might fetch some data and serve it back to your host.

To communicate like this with another Moodle host, you'd normally use the Moodle Network [1] features, but it's also possible for other kinds of program to contact your Moodle, using plain-old-XML-RPC, bypassing Moodle Network's encryption or signed-message features.

This is only likely to be useful if you have another application which:

• is not a Moodle
• is completely under your control (for security reasons)

By default, there are four kinds of function that might be called remotely:

• special 'system' functions
• methods of an authorisation object
• methods of an enrolment object
• functions in a module

The system functions return information about the services and methods that your API is making available to remote servers. These functions are:

• system.listMethods
• system.methodSignature
• system.methodHelp
• system.listServices

The dot-notation is not an XML-RPC standard, but it does seem to be widely deployed, so we figured it would be useful to implement that. You can call all of these methods with a slash (like system/listMethods) if that's important to you. Missing from this list is a non-standard method, that we implemented to help with key-exchange and key-rotation:

• system.keyswap

This method returns the public key that your Moodle and Mahara peers will use for message encryption and signing. It is always possible to call this method from any host without signing or encryption, otherwise Moodles would never be able to exchange keys, and for that reason, it might be really useful to use as a test function. If you get a result back from this function, you have a foot in the door to setting up plaintext XML-RPC between your application and Moodle.

The server script

• allow trusted sites to access web services by configuring admin/mnet/trustedhosts.php
• start by pointing your browser to mnet/xmlrpc/server.php - this should show an XML error message
• use POST data in this format:

// $method is something like: "mod/forum/lib/forum_add_instance"
// $params is an array of parameters. A parameter might itself be an array.
// use only Whitelist characters that are permitted in a method name
// The method name must not begin with a / - avoid absolute paths
// A dot character . is only allowed in the filename, i.e. something.php

• use mnet/xmlrpc/client.php to make remote xmlrpc calls

See also

• Using Moodle Web Services forum