You use RestAllowed and UIAllowed on a ViewModel to control whether it can be called as a REST endpoint, opened in the Turnkey web UI, or both.
Choose how a ViewModel may be reached
These ViewModel settings have separate purposes:
| Setting | Default | What it controls | Typical use |
|---|---|---|---|
| RestAllowed | FALSE | Whether the ViewModel can be invoked through a Turnkey REST URL. | Enable it for a ViewModel that supplies data or operations to another system. |
| UIAllowed | TRUE | Whether the ViewModel can be opened in the Turnkey web UI, including through a deep link. | Disable it for a ViewModel intended only for server-side execution, REST, templates, reports, or transformations. |
Set the values according to the ViewModel's intended entry points:
| ViewModel purpose | RestAllowed | UIAllowed | Result |
|---|---|---|---|
| Normal Turnkey screen | FALSE | TRUE | Users can open the screen in the web UI. It is not exposed as REST. |
| REST-only endpoint | TRUE | FALSE | A REST client can call the ViewModel, but a user cannot open it in the web UI. |
| Screen and REST endpoint | TRUE | TRUE | The same ViewModel can be reached through the UI and REST. |
| Internal/server-side ViewModel | FALSE | FALSE | The ViewModel is not available through either public entry point. |
Configure a REST-only ViewModel
Use this pattern when another application uses a ViewModel as an API endpoint and the ViewModel is not intended to be a screen.
- Select the ViewModel in MDriven Designer.
- Set its RestAllowed tagged value to TRUE.
- Set its UIAllowed tagged value to FALSE.
- Save and upload the model to the MDrivenServer.
- Call the ViewModel through a REST route.
For example, a ViewModel named ViewOneThing can be called with the root-object reference 11!1:
http://localhost:5052/TurnkeyRest/Get?command=ViewOneThing&id=11!1
http://localhost:5052/Rest/ViewOneThing/Get?id=11!1
http://localhost:5052/Rest/ViewOneThing/Get/11!1
The REST route must include the HTTP verb, such as Get. The /Rest/ route format is available for all supported verbs. For complete route formats, request parameters, root-object IDs, and GET/POST processing, see HowTos:Expose REST Service.
Understand deep-link protection
A deep link is a URL that opens a specific ViewModel directly instead of navigating to it from the application menus. In Turnkey web applications, users may save, share, or construct such URLs.
When UIAllowed is FALSE, the Turnkey web UI does not show that ViewModel, even if someone attempts to reach it by a deep link. The default behavior for an unavailable UI is to route to the login screen. This avoids revealing a ViewModel that was designed for another purpose.
Set UIAllowed to FALSE for ViewModels such as:
- Server-side ViewModels executed by application logic.
- REST endpoint ViewModels.
- Tajson or other template-oriented ViewModels.
- Report ViewModels.
- DeepClone or transformation ViewModels.
For example, a ViewModel that transforms data for a background process may contain data and actions that make sense only to the process. Set UIAllowed=FALSE so a user cannot guess its name and open it as a page.
Documentation:Span.Eco.UIAllowed describes the UIAllowed setting and its use with REST pages.
REST access is not UI access
Setting RestAllowed to TRUE enables REST routing for the ViewModel; it does not make the ViewModel visible in the UI. Setting UIAllowed to FALSE blocks UI access; it does not block REST calls when RestAllowed is TRUE.
This separation lets you expose a backend endpoint without also creating a browser-accessible screen:
RestAllowed = TRUE
UIAllowed = FALSE
When a REST request reaches Turnkey, it checks that RestAllowed is set, finds the ViewModel and its root object, and then checks the ViewModel's access groups. Configure access groups when the endpoint requires authenticated or restricted access. Do not treat UIAllowed as an authorization mechanism for REST calls.
Design REST ViewModels deliberately
A REST-enabled ViewModel can receive parameters through ViewModel variables and execute its root-level actions. Keep endpoint behavior explicit:
- Use ViewModel variables of type String for extra URL parameters.
- Use root-level actions to retrieve data for GET or process incoming data for POST.
- Use action Disable/ReadOnly expressions when behavior depends on the REST verb. The request verb is available in
vRestVerbwhen that variable exists. - Send complete object IDs, such as a GUID or an ID that includes its class identifier. A shortcut ID without a class identifier can cause problems.
For example, an action that must not run for a read request can use an expression based on the REST verb:
vRestVerb<>'Put'
Read HowTos:Expose REST Service for the supported verbs, request data handling, JSON processing, returned data, and status-code variables.
Calling other REST services
RestAllowed controls exposing this ViewModel to callers. It is different from calling an external REST service from a ViewModel. For outbound calls, use the REST operators available through selfVM, such as RestGet, RestPost, and RestDownload. See Documentation:Rest Services In MDriven and Documentation:OCLOperators RestPut.