Securing APIs

Use the @secureApi decorator to protect and manage access to an API connector.

You can use this decorator to protect each endpoint separately, or all endpoints within the connector.

When you use the @secureApi decorator, the decorated function accepts a parameter of type ApiCallContext (a dict in Python), which provides the full context of the API call. This includes details such as the endpoint ID, server URL, HTTP method, request parameters, and more.

The security function returns a boolean: true permits the request and false denies it.

Note

Squid supports two flavors of API connectors, both of which can be secured using the same @secureApi decorator. These two flavors are OpenAPI (provided using an OpenAPI document) and regular REST API.

Securing a specific endpoint

TypeScript

Backend code

import { secureApi, SquidService, ApiCallContext } from '@squidcloud/backend';

export class ExampleService extends SquidService {
  @secureApi('usersApi', 'updateUserSalary')
  secureUpdateUserSalaryEndpoint(context: ApiCallContext): boolean {
    // TODO - Implement your security logic here
  }
}

Python

Backend code

from squidcloud_backend import SquidService, secure_api


class ExampleService(SquidService):
    @secure_api('usersApi', 'updateUserSalary')
    def secure_update_user_salary_endpoint(self, context: dict) -> bool:
        # TODO - Implement your security logic here
        return False

Securing all the endpoints in the connector

TypeScript

Backend code

import { secureApi, SquidService, ApiCallContext } from '@squidcloud/backend';

export class ExampleService extends SquidService {
  @secureApi('usersApi')
  secureUsersApi(context: ApiCallContext): boolean {
    // TODO - Implement your security logic here
  }
}

Python

Backend code

from squidcloud_backend import SquidService, secure_api


class ExampleService(SquidService):
    @secure_api('usersApi')
    def secure_users_api(self, context: dict) -> bool:
        # TODO - Implement your security logic here
        return False

The code samples above demonstrate how to secure an API connector using the @secureApi decorator. This decorator takes two parameters:

1. The ID of the API connector, which can be found in the Squid Console.
2. (Optional) The name of the endpoint to secure.

If you don't provide the name of the endpoint, the @secureApi decorator will secure all endpoints in the connector.

In TypeScript, the context is a typed ApiCallContext object; in Python, the security function receives the same context as a dict with keys such as integrationId, endpointId, url, method, and body.

Note

In Python, always declare the context parameter on a security function, even if you don't use it. Unlike TypeScript, Python does not ignore extra call arguments.