REST API for Oracle Commerce Cloud 22A

updateXssConfiguration

put

/ccadmin/v1/merchant/xssConfiguration

Update anti-XSS (anti-cross-site-scripting) configuration. Allows whitelisting of endpoints by URI prefix or endpoint id and configuring specific XML tags to allow.

Request

Supported Media Types

application/json

Root Schema : updateXssConfiguration_request

Type: object

Show Source

endpointIdsToAlwaysValidate(optional): array endpointIdsToAlwaysValidate

List of endpoints by id that will have their request bodies XSS validated even if they fall under the whitelists. This is an editable list.
endpointIdsWhitelist(optional): array endpointIdsWhitelist

List of endpoints by id that will not have their request bodies XSS validated. This is an editable list.
htmlValidatorAllowedAttributeAdditions(optional): array htmlValidatorAllowedAttributeAdditions

Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.
htmlValidatorAllowedTagAdditions(optional): array htmlValidatorAllowedTagAdditions

Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.
htmlValidatorEnabled(optional): boolean

Whether the HTML parser-based anti-XSS validator is enabled.
illegalAttributeNames(optional): array illegalAttributeNames

Editable illegal XML attribute name list.
tagWhitelist(optional): array tagWhitelist

The list of XML tags that are allowed via whitelist. This is the built-in list and is read-only
tagWhitelistAdditions(optional): array tagWhitelistAdditions

List of additional XML tags that are allowed via whitelist. This is an editable list.
uriPrefixesWhitelist(optional): array uriPrefixesWhitelist

List of URI prefixes. Endpoints whose URI's include any of these prefixes will not have their request bodies XSS validated. This is an editable list.

{
    "properties":{
        "htmlValidatorEnabled":{
            "description":"Whether the HTML parser-based anti-XSS validator is enabled.",
            "type":"boolean"
        },
        "htmlValidatorAllowedAttributeAdditions":{
            "description":"Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "endpointIdsWhitelist":{
            "description":"List of endpoints by id that will not have their request bodies XSS validated. This is an editable list.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "uriPrefixesWhitelist":{
            "description":"List of URI prefixes. Endpoints whose URI's include any of these prefixes will not have their request bodies XSS validated. This is an editable list.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "illegalAttributeNames":{
            "description":"Editable illegal XML attribute name list.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "htmlValidatorAllowedTagAdditions":{
            "description":"Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "tagWhitelistAdditions":{
            "description":"List of additional XML tags that are allowed via whitelist. This is an editable list.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "tagWhitelist":{
            "description":"The list of XML tags that are allowed via whitelist. This is the built-in list and is read-only",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "endpointIdsToAlwaysValidate":{
            "description":"List of endpoints by id that will have their request bodies XSS validated even if they fall under the whitelists. This is an editable list.",
            "type":"array",
            "items":{
                "type":"string"
            }
        }
    },
    "example":{
        "endpointIdsWhitelist":[
            "applicationJavaScript"
        ],
        "uriPrefixesWhitelist":[
            "/ccadmin/v1"
        ],
        "tagWhitelistAdditions":[
            "foo",
            "bar"
        ],
        "tagWhitelist":[
            "a",
            "abbr",
            "acronym",
            "address",
            "b",
            "big",
            "blockquote",
            "br",
            "caption",
            "cite",
            "code",
            "col",
            "colgroup",
            "dd",
            "defn",
            "del",
            "dir",
            "div",
            "dt",
            "em",
            "h1",
            "h2",
            "h3",
            "h4",
            "h5",
            "h6",
            "hr",
            "i",
            "img",
            "ins",
            "kbd",
            "li",
            "link",
            "menu",
            "ol",
            "p",
            "pre",
            "q",
            "samp",
            "small",
            "span",
            "strong",
            "sub",
            "sup",
            "table",
            "tbody",
            "td",
            "tfoot",
            "th",
            "thread",
            "tr",
            "tt",
            "ul",
            "var"
        ],
        "endpointIdsToAlwaysValidate":[
            "createProduct",
            "updateProduct"
        ]
    }
}

Example:

{
    "endpointIdsWhitelist":[
        "applicationJavaScript"
    ],
    "uriPrefixesWhitelist":[
        "/ccadmin/v1"
    ],
    "tagWhitelistAdditions":[
        "foo",
        "bar"
    ],
    "tagWhitelist":[
        "a",
        "abbr",
        "acronym",
        "address",
        "b",
        "big",
        "blockquote",
        "br",
        "caption",
        "cite",
        "code",
        "col",
        "colgroup",
        "dd",
        "defn",
        "del",
        "dir",
        "div",
        "dt",
        "em",
        "h1",
        "h2",
        "h3",
        "h4",
        "h5",
        "h6",
        "hr",
        "i",
        "img",
        "ins",
        "kbd",
        "li",
        "link",
        "menu",
        "ol",
        "p",
        "pre",
        "q",
        "samp",
        "small",
        "span",
        "strong",
        "sub",
        "sup",
        "table",
        "tbody",
        "td",
        "tfoot",
        "th",
        "thread",
        "tr",
        "tt",
        "ul",
        "var"
    ],
    "endpointIdsToAlwaysValidate":[
        "createProduct",
        "updateProduct"
    ]
}

Nested Schema : endpointIdsToAlwaysValidate

Type: array

List of endpoints by id that will have their request bodies XSS validated even if they fall under the whitelists. This is an editable list.

Show Source

Array of: string

{
    "description":"List of endpoints by id that will have their request bodies XSS validated even if they fall under the whitelists. This is an editable list.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : endpointIdsWhitelist

Type: array

List of endpoints by id that will not have their request bodies XSS validated. This is an editable list.

Show Source

Array of: string

{
    "description":"List of endpoints by id that will not have their request bodies XSS validated. This is an editable list.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : htmlValidatorAllowedAttributeAdditions

Type: array

Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.

Show Source

Array of: string

{
    "description":"Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : htmlValidatorAllowedTagAdditions

Type: array

Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.

Show Source

Array of: string

{
    "description":"Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : illegalAttributeNames

Type: array

Editable illegal XML attribute name list.

Show Source

Array of: string

{
    "description":"Editable illegal XML attribute name list.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : tagWhitelist

Type: array

The list of XML tags that are allowed via whitelist. This is the built-in list and is read-only

Show Source

Array of: string

{
    "description":"The list of XML tags that are allowed via whitelist. This is the built-in list and is read-only",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : tagWhitelistAdditions

Type: array

List of additional XML tags that are allowed via whitelist. This is an editable list.

Show Source

Array of: string

{
    "description":"List of additional XML tags that are allowed via whitelist. This is an editable list.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : uriPrefixesWhitelist

Type: array

List of URI prefixes. Endpoints whose URI's include any of these prefixes will not have their request bodies XSS validated. This is an editable list.

Show Source

Array of: string

{
    "description":"List of URI prefixes. Endpoints whose URI's include any of these prefixes will not have their request bodies XSS validated. This is an editable list.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Response

Supported Media Types

application/json

200 Response

Following model is returned when operation succeeds.

Root Schema : updateXssConfiguration_response

Type: object

Show Source

endpointIdsToAlwaysValidate(optional): array endpointIdsToAlwaysValidate

Editable endpoint ids that will be XSS validated even if they fall under the whitelists.
endpointIdsWhitelist(optional): array endpointIdsWhitelist

Editable whitelist of endpoint ids that will not perform XSS validation.
htmlValidatorAllowedAttributeAdditions(optional): array htmlValidatorAllowedAttributeAdditions

Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.
htmlValidatorAllowedTagAdditions(optional): array htmlValidatorAllowedTagAdditions

Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.
htmlValidatorEnabled(optional): boolean

Whether the HTML parser-based anti-XSS validator is enabled.
illegalAttributeNames(optional): array illegalAttributeNames

Editable illegal XML attribute name list.
tagWhitelist(optional): array tagWhitelist

Read-only built-in setting for XML tags that are allowed in input values.
tagWhitelistAdditions(optional): array tagWhitelistAdditions

Editable additional XML tags that are allowed in input values.
uriPrefixesWhitelist(optional): array uriPrefixesWhitelist

Editable whitelist of endpoint URI prefixes that will not perform XSS validation.

{
    "properties":{
        "htmlValidatorEnabled":{
            "description":"Whether the HTML parser-based anti-XSS validator is enabled.",
            "type":"boolean"
        },
        "htmlValidatorAllowedAttributeAdditions":{
            "description":"Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "endpointIdsWhitelist":{
            "description":"Editable whitelist of endpoint ids that will not perform XSS validation.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "uriPrefixesWhitelist":{
            "description":"Editable whitelist of endpoint URI prefixes that will not perform XSS validation.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "illegalAttributeNames":{
            "description":"Editable illegal XML attribute name list.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "htmlValidatorAllowedTagAdditions":{
            "description":"Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "tagWhitelistAdditions":{
            "description":"Editable additional  XML tags that are allowed in input values.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "tagWhitelist":{
            "description":"Read-only built-in setting for XML tags that are allowed in input values.",
            "type":"array",
            "items":{
                "type":"string"
            }
        },
        "endpointIdsToAlwaysValidate":{
            "description":"Editable endpoint ids that will be XSS validated even if they fall under the whitelists.",
            "type":"array",
            "items":{
                "type":"string"
            }
        }
    }
}

Nested Schema : endpointIdsToAlwaysValidate

Type: array

Editable endpoint ids that will be XSS validated even if they fall under the whitelists.

Show Source

Array of: string

{
    "description":"Editable endpoint ids that will be XSS validated even if they fall under the whitelists.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : endpointIdsWhitelist

Type: array

Editable whitelist of endpoint ids that will not perform XSS validation.

Show Source

Array of: string

{
    "description":"Editable whitelist of endpoint ids that will not perform XSS validation.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : htmlValidatorAllowedAttributeAdditions

Type: array

Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.

Show Source

Array of: string

{
    "description":"Editable list of additional attribute names for the HTML parser-based anti-XSS validator to allow.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : htmlValidatorAllowedTagAdditions

Type: array

Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.

Show Source

Array of: string

{
    "description":"Editable list of additional tag names for the HTML parser-based anti-XSS validator to allow.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : illegalAttributeNames

Type: array

Editable illegal XML attribute name list.

Show Source

Array of: string

{
    "description":"Editable illegal XML attribute name list.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : tagWhitelist

Type: array

Read-only built-in setting for XML tags that are allowed in input values.

Show Source

Array of: string

{
    "description":"Read-only built-in setting for XML tags that are allowed in input values.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : tagWhitelistAdditions

Type: array

Editable additional XML tags that are allowed in input values.

Show Source

Array of: string

{
    "description":"Editable additional  XML tags that are allowed in input values.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Nested Schema : uriPrefixesWhitelist

Type: array

Editable whitelist of endpoint URI prefixes that will not perform XSS validation.

Show Source

Array of: string

{
    "description":"Editable whitelist of endpoint URI prefixes that will not perform XSS validation.",
    "type":"array",
    "items":{
        "type":"string"
    }
}

Example Response (application/json)

{
    "endpointIdsWhitelist":[
        "applicationJavaScript"
    ],
    "uriPrefixesWhitelist":[
        "/ccadmin/v1"
    ],
    "tagWhitelistAdditions":[
        "bar",
        "foo"
    ],
    "endpointIdsToAlwaysValidate":[
        "createProduct",
        "updateProduct"
    ]
}

Default Response

The error response. The following are the internal error codes thrown by this API when the request processing fails in Oracle Commerce Cloud: |Error Code|Description| |------------------|------------------| |13001|Validation errors were found in the input.|

Root Schema : errorModel

Type: object

Show Source

devMessage(optional): string

An optional non-localized message containing technical information for developers
errorCode(optional): string

The numerical code identifying the error
errors(optional): array errors

An optional list of errors if multiple errors were encountered
message(optional): string

The localized message describing the error
moreInfo(optional): string

An optional non-localized message with more information
o:errorPath(optional): string

An optional machine readable description of where the error occurred
status(optional): string

The HTTP status code
type(optional): string

The URI to the HTTP state code definition

{
    "type":"object",
    "properties":{
        "errorCode":{
            "description":"The numerical code identifying the error",
            "type":"string"
        },
        "message":{
            "description":"The localized message describing the error",
            "type":"string"
        },
        "type":{
            "description":"The URI to the HTTP state code definition",
            "type":"string"
        },
        "devMessage":{
            "description":"An optional non-localized message containing technical information for developers",
            "type":"string"
        },
        "moreInfo":{
            "description":"An optional non-localized message with more information",
            "type":"string"
        },
        "o:errorPath":{
            "description":"An optional machine readable description of where the error occurred",
            "type":"string"
        },
        "errors":{
            "description":"An optional list of errors if multiple errors were encountered",
            "type":"array",
            "items":{
                "type":"object",
                "properties":{
                    "errorCode":{
                        "description":"The numerical code identifying the error",
                        "type":"string"
                    },
                    "message":{
                        "description":"The localized message describing the error",
                        "type":"string"
                    },
                    "devMessage":{
                        "description":"An optional non-localized message containing technical information for developers",
                        "type":"string"
                    },
                    "moreInfo":{
                        "description":"An optional non-localized message with more information",
                        "type":"string"
                    },
                    "o:errorPath":{
                        "description":"An optional machine readable description of where the error occurred",
                        "type":"string"
                    },
                    "status":{
                        "description":"The HTTP status code",
                        "type":"string"
                    }
                }
            }
        },
        "status":{
            "description":"The HTTP status code",
            "type":"string"
        }
    }
}

Nested Schema : errors

Type: array

An optional list of errors if multiple errors were encountered

Show Source

Array of: object items

{
    "description":"An optional list of errors if multiple errors were encountered",
    "type":"array",
    "items":{
        "type":"object",
        "properties":{
            "errorCode":{
                "description":"The numerical code identifying the error",
                "type":"string"
            },
            "message":{
                "description":"The localized message describing the error",
                "type":"string"
            },
            "devMessage":{
                "description":"An optional non-localized message containing technical information for developers",
                "type":"string"
            },
            "moreInfo":{
                "description":"An optional non-localized message with more information",
                "type":"string"
            },
            "o:errorPath":{
                "description":"An optional machine readable description of where the error occurred",
                "type":"string"
            },
            "status":{
                "description":"The HTTP status code",
                "type":"string"
            }
        }
    }
}

Nested Schema : items

Type: object

Show Source

devMessage(optional): string

An optional non-localized message containing technical information for developers
errorCode(optional): string

The numerical code identifying the error
message(optional): string

The localized message describing the error
moreInfo(optional): string

An optional non-localized message with more information
o:errorPath(optional): string

An optional machine readable description of where the error occurred
status(optional): string

The HTTP status code

{
    "type":"object",
    "properties":{
        "errorCode":{
            "description":"The numerical code identifying the error",
            "type":"string"
        },
        "message":{
            "description":"The localized message describing the error",
            "type":"string"
        },
        "devMessage":{
            "description":"An optional non-localized message containing technical information for developers",
            "type":"string"
        },
        "moreInfo":{
            "description":"An optional non-localized message with more information",
            "type":"string"
        },
        "o:errorPath":{
            "description":"An optional machine readable description of where the error occurred",
            "type":"string"
        },
        "status":{
            "description":"The HTTP status code",
            "type":"string"
        }
    }
}