Is the Audience Manager Webservice API documented and can it be restricted to import only?

Question

The docs mention installation of the Audience Manager Webservice which is a service endpoint to import and export contacts. I cannot however find a client DLL to reference in my .NET projects, or indeed any documentation on how to use the API - am I missing something?

Secondly, I am only interested in importing contact data using this service, and indeed it could be considered a security risk to expose the export methods - is there any way that the service can be restricted to only allow importing of data?

Answer 1

There is no official documentation on the usage of the API. But there is API documentation available for the Import classes of the public API -- and the web methods are almost identical. So if you know how to import/export using the API, you'll likely know how to do the same with the web service. I'll see if we can put some example code out there for people interested in it.

Anyway, the security question you ask is a bit more interesting. Users are, of course, authorized within Tridion and constrained to the rights and permissions they have there. But mostly, if you can Import you are also allowed to Export.

However, this is a WCF web service and hosted in IIS. So you can apply security rules there to restrict who can access the web service and who cannot. I'd certainly recommend that you lock down the IP addresses and user credentials that can access it, so that you can control who uses it.

If you control who can access it, it's easier to lock down features too. You could, for instance, have the only client that is allowed to access the web service, and only expose the Import functionality in that client.

You could also block the streamDownload endpoint URL in your firewall to block the export -- or even go so far as to remove the download endpoint from the configuration (but be prepared for errors in the latter case).