All APIs should use permissions

[eaquigley]

---

Author Name: Michael Bar-Sinai (@michbarsinai)
Original Redmine Issue: 3870, https://redmine.hmdc.harvard.edu/issues/3870
Original Date: 2014-04-22
Original Assignee: Michael Bar-Sinai

---

And, preferably, Commands

[michbarsinai]

This will be a chain issue, as I'm not the only one doing APIs. Let's start with my beans and then pass it along.

Bean	Status
AbstractApiBean	OK
Access	OK
Admin	Separate issue - see #976
BuiltinUsers	OK
Config	Waiting (Phil?)
DataTagsAPI	OK
DatasetFieldServiceApi	Waiting (Leonid?)
Datasets	OK
Dataverses	OK
DownloadInstanceWriter	Waiting (Leonid?)
Files	OK
Index	Waiting (Phil?)
Mail	Waiting (Gustavo?)
Meta	Waiting (Leonid?)
MetadataBlocks	Not using commands or API keys, but does not reveal any info and can't change anything.
Roles	OK
Search	Waiting (Phil?)
TestIngest	Waiting (Leonid?)
WorldMapRelatedData	Waiting
datadeposit	I guess not, but need to validate with @raprasad

[michbarsinai]

Over to Gustavo for re-assignment to other API owners.

[scolapasta]

It really depends on the nature of the API. Admin APIs and index, etc, often cannot use Commands or permissions.

[pdurbin]

For the Index API we could require an API token and further require that the token owner, the AuthenticatedUser, has the "superuser" boolean set to "true".

[michbarsinai]

Closing, as agreed with @scolapasta.
Now that #976 is done, APIs either use permissions or can be blocked.