Change Details

We need to log access at the PHP level but can't currently distinguish levels of access at the api level atm. If we only logged at an access level (eg. via JS on the front-end) then someone could bypass our logging by navigating directly to the API url. Since the API returns all information a user has access to for a given IP regardless of whether or not the front-end intends to show it and because we intend to log when people access a limited amount of information vs when they access the full set we should 1. enforce the limitations and 2. track it at the API level. AC: [ ] API returns a different set of data depending on whether or not the popup or the widget calls it. This could be done via a parameter (failing when appropriate) or by splitting up the endpoint.

We need to log access at the PHP level but can't currently distinguish levels of access at the api level atm. If we only logged at an access level (eg. via JS on the front-end) then someone could bypass our logging by navigating directly to the API url. Since the API returns all information a user has access to for a given IP regardless of whether or not the front-end intends to show it and because we intend to log when people access a limited amount of information vs when they access the full set we should 1. enforce the limitations and 2. track it at the API level. AC: [ ] API returns a different set of data depending on whether or not the popup or the widget calls it. This should be done via a parameter.

We need to log access at the PHP level but can't currently distinguish levels of access at the api level atm. If we only logged at an access level (eg. via JS on the front-end) then someone could bypass our logging by navigating directly to the API url. Since the API returns all information a user has access to for a given IP regardless of whether or not the front-end intends to show it and because we intend to log when people access a limited amount of information vs when they access the full set we should 1. enforce the limitations and 2. track it at the API level. AC: [ ] API returns a different set of data depending on whether or not the popup or the widget calls it. This cshould be done via a parameter (failing when appropriate) or by splitting up the endpoint.