Moodle Web Service - Testing

Why we started this project

So, why did we start this project? After attending the first days of college I asked if it would be possible to get access to the Moodle Webservice (API). Since it was the first time someone wanted to get access to it, there needed be some testing before handing out the tokens. Which the college would do themselves. But they also offered a different method of obtaining the tokens. I just needed to do the testing myself and present all my results to them.

The team

I thought this would be a great way of learning while working towards my goal to get the tokens. In the following days I asked some fellow students if they would want to work on this together. The one most ambitious with this project was Jannis. Him and I are the main people working on this project! Carlo also joined the group.

Setting up Moodle

So we decided to host our own Moodle server on a subdomain from Jannis. After some setup struggles he made it work, which was really exciting! Finally we could take a deeper look into the Moodle webservice.

First steps

We started with browsing the documentation and the wiki to activate the API tokens. That worked really well!

The setup from the Moodle API is a little unconventional. We followed these steps:

  1. Enable web service
  2. Enable protocol (we use the REST protocol)
  3. A role needs to be created that has the right to use the API
  4. Create an API user (This is not neccessary, if you want to grant access to an already existing user
  5. Create role for the user, with the protocol capabilities and assign the user to it
  6. Select a service and asign functions to it (the functions are the different requests that can be made)
  7. Add the user to the service
  8. Create Token

Everyone who has access to an admin account can see a full setup list here:
[YOUR_DOMAINNAME]/category.php?category=webservicesettings

Playing Around

After finishing the setup, we started to play around. We were able to determine that it is possible to give an user the rights to access their courses (wsfunction: core_enrol_get_users_courses). If the user requests the function, the response will only contain the content of the courses that the user has access to. This is our first big milestone, because now we know, that some functions are viable for users and not all are authorized to access all the data saved in moodle.

Testing more functions

...

TL:DR - Summary

...