It is recommended to always test your calls to confirm they are working as intended before running them against your production assets. The Orange Logic platform offers the following features to test APIs: - **Backup site**: Each instance of Orange Logic has a backup site. If you are making a very large number of API calls, consider working in the backup site to avoid any performance issues that might affect other test site users. Submit a support request and confirm your testing plan with Orange Logic staff before working in the backup site or making large batches of API calls. - **Test site**: Some Orange Logic plans include a dedicated test site, which you can use to try out new features, configure new workflows, set up new integrations, and test APIs. Your production site database is regularly copied to your test site, which allows you to try out new endpoints before your changes impact users or alter live data. > 📙 Feature documentation > > Orange Logic users with a Link account can go to the following articles to learn more: > > - Assets in test environments > - Test environment FAQs - **Personal folders**: By default, each user has a personal folder in the Personal Folders directory. This directory is separate from the Library folder, which is the root folder for all sub-folders and assets. You can upload test assets to your personal folder and test calls against them. - **Parameter sessions**: You can create [parameter sessions](ref:parameter-sessions) to test new workflows and configurations. When you are working in a session, your changes are only visible in that session, which means you can test configurations without impacting other users. ## Create API accounts Before you can begin running and testing APIs, you must have an Orange Logic account. If you can’t create user accounts yourself, contact your Orange Logic administrator. Typically, organizations create a single account with a shared email address that any individual working with APIs can access. In addition, we recommend creating an account for each specific API use case. For example, you might create an Adobe Integration API User account in addition to your general-use API account. After you’ve completed your initial testing and you’re ready to move your API setup from your test environment to your production environment, you’ll re-create your API user accounts in prod. Rebuilding the API-related accounts gives you an additional opportunity to confirm that the accounts have the appropriate Security Functions and Permissions. ### Orange Logic Security Functions and Permissions Security Functions and Permissions determine which APIs a user can run and which assets a user can work with. - **Security Functions** determine whether a user can perform a certain action or access a specific feature. For example, a Security Function allows a user to upload assets. - **Permissions** grant access to assets and determine what a user can do with an asset (download, edit, share, delete, etc.). > 🎓 **Insight: Permissions and Security Functions** > > Each asset (including folders) has a Permissions tab where you can assign permissions to users and groups. There are many levels of permissions, which gives you granular control over how users can interact with the asset. > > For example, if you want users to be able to download an asset, you can activate the Show Dwnld Btn permission. If you want to allow users to edit an asset’s metadata, you can activate the Edit permission. The Admin level activates all permissions, and it allows users to manage the asset’s permissions. > > Security Functions determine whether a user can perform a certain action or access a specific feature. For example, users need specific security functions to run reports, download plugins, manage asset watermarks, and more. Security Functions are assigned to groups. To call an API, users need the Security Functions to complete the relevant actions, such as uploading assets or generating links. In addition, some APIs have unique Security Functions. For example, to run the [Search API](ref:search-api), users need the **Access to the search API **Security Function. > ℹ️ Note > > Most users who run APIs should be assigned the **Can bypass new device login verification **Security Function. This Security Function allows the user to log in to and interact with Orange Logic without needing to complete the new device verification step. API users need permissions to access assets via API, just as they would to access those assets in the Orange Logic interface. For example, the [Search API](ref:search-api) returns only assets that a user has Permissions to view, and the [Upload APIs](ref:upload) allows users to upload assets only to containers they have Permission to edit. Administrators should carefully consider which actions API users need to complete and assign Security Functions and permissions accordingly. A user account can be a member of multiple groups, so you can separate Security Functions and specific asset permissions into discrete groups for ease of management. Alternatively, administrators can create accounts for API users and add them to the \*SuperAdmin group, which is granted full access to all Security Functions and permissions. If calling an API results in unexpected access errors, ask your Orange Logic administrator to check your Security Functions and Permissions to ensure you have the appropriate access. ## API testing tools Many Orange Logic API endpoints offer robust functionality that must be tested in a full API client, such as Postman. For example, [DataTable APIs](ref:datatable-apis) use unique query operators, such as **`++`**, that can’t be used in basic API testing tools like Swagger. Many API clients allow you to import the OpenAPI specification JSON, which you can find in Swagger. - Access Swagger from the Orange Logic interface in <> (**Administration **> **Maintenance **> **APIs **> **Swagger UI**). - Go directly to Swagger by adding **/swagger **to the end of your Orange Logic URL. For example: [https://mangovations.com/swagger]. - Go directly to the JSON file by adding **/swagger/application/swagger.json **to the end of your Orange Logic URL. For example: [https://mangovations/swagger/application/swagger.json]. [block:image] { "images": [ { "image": [ "https://files.readme.io/1beca5ce3126fb64b769034fdea1a0cadbc719079dac7f7c440ee71944fd7613-OpenAPI_specification_JSON_in_Swagger.png", "", "OpenAPI specification JSON in Swagger" ], "align": "center", "sizing": "600px", "caption": "OpenAPI specification JSON in Swagger" } ] } [/block] If you've logged in to Orange Logic and have active browser cookies, you can test simple API calls in Swagger or you can run basic **GET** calls directly in your browser. > ℹ️ Note > > - If an incorrect authentication token and a correct session cookie are provided in the same request, the API uses the cookie. > - Swagger always uses session cookies, so you must log in to the Orange Logic interface to test APIs in Swagger.