Search code examples
jsonopenproject

How to get an attachment's data with the openproject API

I'm currently trying to show the data about an openproject workpackage in my website using the openproject api v3 (I'm using PHP with symfony.).

I have no issue getting the general data (subject, description, priority, etc), but I'm not sure I know how to show the attachments to the user.

I tried using "/api/v3/work_packages/".$id."/attachments", but there is no image in the json returned:

"_type":"Collection",
"total":1,
"count":1,
"_embedded":{
    "elements":[{
        "_type":"Attachment",
        "id":1888,"fileName":"128-128-logo.png",
        "fileSize":9583,
        "description":{"format":"plain","raw":null,"html":""},
        "contentType":"image/png",
        "digest":{"algorithm":"md5","hash":"/*-hash-here-*/"},
        "createdAt":"2018-07-09T16:49:26Z",
        "_links":{
             "self":{"href":"/api/v3/attachments/1888","title":"128-128-logo.png"},
             "author":{"href":"/api/v3/users/7","title":"User Name"},
             "container":{"href":"/api/v3/work_packages/1697","title":"Subject -\u003E Test Query OpenProject"},
             "downloadLocation":{"href":"/attachments/1888/128-128-logo.png"},
             "delete":{"href":"/api/v3/attachments/1888","method":"delete"}
        }
    }]
},
"_links":{
    "self":{"href":"/api/v3/work_packages/1697/attachments"}
}

I also tried with a direct link to the attachment, but got

"_type":"Attachment",
"id":1888,
"fileName":"128-128-logo.png",
"fileSize":9583,
"description":{"format":"plain","raw":null,"html":""},
"contentType":"image/png",
"digest":{"algorithm":"md5","hash":"/*-hash-here-*/"},
"createdAt":"2018-07-09T16:49:26Z",
"_links":{
    "self":{"href":"/api/v3/attachments/1888","title":"128-128-logo.png"},
    "author":{"href":"/api/v3/users/7","title":"User Name"},
    "container":{"href":"/api/v3/work_packages/1697","title":"Subject -\u003E Test Query OpenProject"},
    "downloadLocation":{"href":"/attachments/1888/128-128-logo.png"},
    "delete":{"href":"/api/v3/attachments/1888","method":"delete"}
}

The download location is not an API url and return 406 - unauthorised if I try to access it with an img tag ( <img src="https://XXXXXX.openproject.com/attachments/1888/128-128-logo.png"> )

So I guess my question is: How do I show my users the attachments even if they don't have an account on my openproject?

Solution

  • To show the attachment on your website you will have to:

    • Grant anonymous access to your openproject instance.
    • Have the attachment in a public project, meaning that it will have to be attached to a work package, wiki page ... of a public project

    Grant anonymous access to your openproject instance

    Uncheck "Authentication required" in the system settings ("Administration" -> "System settings" -> "Authentication" (Tab)") and save.

    enter image description here

    Turn project public

    Check "Public" in the project settings (After navigating to a project -> "Project settings" -> "Information" (Tab)) and save.

    enter image description here

    Only attachments attached to a resource of that now public project will be accessible by your website.

    Consequences

    Everyone will be able to access your OpenProject instance, at least the part with the public project.

    Alternative 1

    If it is a private website and all visitors of that website will also have an account on the OpenProject instance and if it is assured, that they will always be logged into OpenProject when visiting the website, their browser will send the session cookie to the OpenProject instance automatically upon fetching the image which will result in them being authorized to get the attachment.

    Alternative 2

    Once OP 8.0 is released, API clients will be able to download attachments. Then a script with an API key could download the attachments of interest and store them in a location accessible to your website. The website visitors would then get the attachment from the website directly.