How to do a controlled soft-delete with API-key authentication

Question

We generally use (and want to keep) the recycle bin.

We have several object types where we do not allow (soft) delete for the non-admin user roles, because there may be child objects, so we need a casaded delete, or the object impacts the status of its parent object, so we need to update the parent object after deletion.

We solved this by providing custom actions for deletion that trigger a microservice run with higher privilege. In order for the microservice to do a soft-delete, it must run with user credentials such as root. Authentication with an API-key will run it as a system user, which leads to an error in the DELETE operation because a system user does not have a recycle bin.

We know that API-key authentication is the preferred method. However, we do not find a way to switch to it without losing controlled soft delete.

Can you confirm that there is no other option, or are we overlooking something?

Answer 1

Currently there is no other option. The system user has no recycle bin and a soft delete is not possible from a microservice using this user by default.
As a solution for this scenario the yuuvis RAD system could provide a solution by using the default admin account as recycle bin for the system user. Could be implemented in a future version.

As a workaound/solution for now: I would recommend to use a dedicated user and assign it to the microervice. As it is not possible at the moment to get an API key for a user, the mircroservice has to store username/password in the configuration. The calls can be done by using basic authentication. This dedicated user must have the rights to move the objects to the recycle bin. Currently there is no other way.

br