System Settings API#

Read/write over MnxSettingsManagement. Writes gated behind EnableSettingsWrites and the GroupWrite policy.

• Endpoints:
  • GET /api/v1/settings (optional ?moduleId=N)
  • GET /api/v1/settings/{settingId}
  • PUT /api/v1/settings/{settingId} { settingValue }
• Auth: [Authorize] reads; [Authorize(Policy = "GroupWrite")] writes
• Feature flag: FeatureFlags:EnableSettingsWrites (default false)
• Jira: BFC-22
• Legacy source: MnxSettingsManagement

Flow — update#

flowchart TD
    Req[PUT /settings/id] --> Flag{EnableSettingsWrites?}
    Flag -->|false| R404[404]
    Flag -->|true| Auth{JWT mod_admin?}
    Auth -->|no| R403[403]
    Auth -->|yes| Svc[SettingsService.Update]
    Svc --> Load[Load row]
    Load --> Show{IsShowSetting=true?}
    Show -->|no| R404b[404 — hidden rows invisible]
    Show -->|yes| Len{len over ValueMaxLength?}
    Len -->|yes| R400[400]
    Len -->|no| Save[UPDATE settingValue]
    Save --> R200[200]

Rules#

• IsShowSetting=false rows are completely invisible — no list, no get-by-id, no PUT target. 404 on both.
• ValueMaxLength enforced server-side — pre-write check returns 400 for oversized payloads. Prevents legacy truncation surprises.
• Reads always available (subject to [Authorize]); writes gated by feature flag AND GroupWrite policy.