Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Identities.md #823

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update Identities.md #823

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 23 additions & 6 deletions guides/Identities.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# About Identities

Each request to a Wix API is associated with a specific identity type, which determines access permissions. If a [method has identity restrictions](#methods-with-restricted-identities), the method reference will include a note specifying the allowed identity types.
Different contexts also limit the identities that can make a given call. For example, apps can only make calls as apps, not as visitors or members.
Every request to a Wix API is made by a specific identity type. For each call, the caller's identity is checked and confirmed to have the necessary permissions.
If a [method has identity restrictions](#methods-with-restricted-identities), the reference documentation will include a note specifying the allowed identity types.

Wix's identity types include:

Expand All @@ -15,18 +15,24 @@ Wix's identity types include:

## Site visitor

An anonymous site visitor who hasn't logged in. Methods that can be called by this identity usually involve operations specific to a particular visitor. These include accessing a list of products, creating and managing a cart, or accessing a login page to authenticate as a member.
An anonymous site visitor is a site visitor who hasn't logged in. Methods that can be called by this identity usually involve operations specific to a particular visitor.

**Context**:
- [Headless](https://dev.wix.com/docs/go-headless/getting-started/about-headless/about-wix-headless) flows can make calls as site visitors.

**Example use cases**:
- A headless site can make calls to Wix's APIs as an anonymous site visitor to access a list of products, create and manage a cart, or access a login page to authenticate as a member.

## Site member

A site member who has logged in. Methods that can be called by this identity usually involve operations specific to a registered member. These include accessing or managing personal data.
- A site member a site visitor who has logged in. Methods that can be called by this identity usually involve operations specific to a registered member. These include accessing or managing personal data.

**Context**:
- [Headless](https://dev.wix.com/docs/go-headless/getting-started/about-headless/about-wix-headless) flows can make calls as site members.

**Example use cases**:
A headless site can make calls to Wix's APIs as a site member to access personal order data or edit their personal member profile.

## Wix user

A Wix user is someone who is logged into their account on **.wix.com**. Users can be site owners or site collaborators, as well as app owners and collaborators who create test sites. Users who create a site are automatically designated as the owner of that site.
Expand All @@ -36,9 +42,13 @@ Methods that can be called by this identity usually involve site maintenance ope
Site owners can invite collaborators and assign them specific [user roles](https://support.wix.com/en/article/roles-permissions-overview) to control permissions. In this case, the methods that the app can access when making calls as a collaborator are limited by the collaborator's user roles.

**Context**:
- [Headless](https://dev.wix.com/docs/go-headless/getting-started/about-headless/about-wix-headless) flows can make calls as Wix Users.
- [Headless](https://dev.wix.com/docs/go-headless/getting-started/about-headless/about-wix-headless) flows can make calls as Wix users.
- Apps can make calls [on behalf of Wix users](https://dev.wix.com/docs/build-apps/develop-your-app/access/authentication/about-authentication#authentication-on-behalf-of-a-wix-user).

**Example use cases**:
- A headless site can make calls to Wix's APIs as a Wix user to edit store products, create a coupon, or create a bookings calendar.
- An app can make calls to Wix's APIs on behalf of a Wix user to edit store products, create a coupon, or create a bookings calendar. These calls are authenticated with the Wix app identity, and XXX

## Wix app

Wix apps are packages of reusable functionality that users can add to their sites. When an app is installed or updated on a Wix site, Wix generates an [app instance](https://dev.wix.com/docs/build-apps/develop-your-app/access/app-instances/about-app-instances) with a unique ID. This ID represents the installed version of the app on that particular site.
Expand All @@ -53,9 +63,12 @@ Learn more about [configuring app permissions](https://dev.wix.com/docs/build-ap
**Context**:
- Apps can make calls as apps.

**Example use cases**:
- An app can make calls to Wix's APIs as a Wix app to edit store products, create a loyalty program, or import an order.

## API key admin

An admin with customized administrative access to a Wix account's sites and projects. [API keys](https://support.wix.com/en/article/about-wix-api-keys) are created and managed in the [API Keys Manager](https://manage.wix.com/account/api-keys) where site owners and co-owners can assign a set of permissions that determine the types of APIs each key can access.
An API key admin is an account admin with customized administrative access to a Wix account's sites and projects. [API keys](https://support.wix.com/en/article/about-wix-api-keys) are created and managed in the [API Keys Manager](https://manage.wix.com/account/api-keys) where site owners and co-owners can assign a set of permissions that determine the types of APIs each key can access.

Methods that can be called by this identity can involve administrative operations at the site or account level. These include managing members or business data.

Expand All @@ -66,6 +79,10 @@ Because API keys must be created by the site owners or co-owners, and passed man
- Site admin flows can make calls as API key admins.
- [Channel](https://support.wix.com/en/article/wix-channels-dashboard-overview) and [Enterprise](https://support.wix.com/en/article/wix-enterprise-an-overview) admin flows can make calls as API key admins.

**Example use cases**:
- A headless admin can make calls to Wix's APIs as an API key admin to invite team members to join the account, manage domains and create store products.
- A Channel or Enterprise admin can make calls to Wix's APIs as an API key admin to invite team members to join the account, manage domains and create store products.


## Methods with restricted identities
By default, methods can be called using any identity.
Expand Down