xaf-web-api

Expose XAF business objects as OData v4 REST endpoints with JWT authentication.

6|2|Updated Mar 3, 2026
One-click install
npx skills add https://github.com/kashiash/xaf-skills --skill xaf-web-api
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: xaf-web-api
Source: https://github.com/kashiash/xaf-skills/tree/main/xaf-web-api
Command: npx skills add https://github.com/kashiash/xaf-skills --skill xaf-web-api

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Expose DevExpress XAF business objects as a secure OData v4 REST API, enabling frontend apps and external clients to query and manipulate data with built-in XAF security, permission checks, and Swagger documentation.

Core Features & Use Cases

  • Expose specific or all business objects via OData endpoints with fine-grained permissions via [AllowedAction] and property-level security via [IgnoreDataMember].
  • Provide JWT-based authentication, Swagger UI, and endpoints for common CRUD and custom actions, suitable for Blazor Server apps or standalone API services.
  • Use cases include building a backend API for a XAF-based SPA or mobile clients, enabling external partners to read/write data with proper security.

Quick Start

Run the Web API host, configure AddWebApi to expose your XAF business objects, and then call the /api/odata endpoints.

Frequently Asked Questions about xaf-web-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I expose DevExpress XAF business objects as a secure REST API?

You can expose XAF business objects as a secure OData v4 REST API by applying programmatic setup in Program.cs, using JWT-based authentication, and enforcing permission checks via [AllowedAction] and [IgnoreDataMember].

Does the XAF Web API support JWT authentication and Swagger documentation?

Yes, the XAF Web API provides JWT-based authentication for secure access and includes Swagger UI documentation for testing the exposed OData v4 endpoints and custom actions.

Can I use XAF OData endpoints with Blazor Server or WinForms applications?

Yes, you can apply this OData v4 REST API setup to projects using XAF v24.2 or v25.1 in Blazor Server, WinForms, or Web API configurations to securely expose business objects.

How do I enforce property-level security on XAF OData endpoints?

You enforce property-level security on XAF OData endpoints by applying the [IgnoreDataMember] attribute to restrict exposed fields and the [AllowedAction] attribute for fine-grained CRUD permission checks.

What is the best way to add custom actions to an XAF OData API?

The best way to add custom actions to an XAF OData API is by using the [Action] attribute, which allows you to expose custom endpoint logic alongside standard CRUD operations with Swagger documentation.

Do I need XAF v24.2 or v25.1 to set up a secure OData API in Program.cs?

Yes, you need a project using XAF v24.2 or v25.1 to programmatically configure the Web API host in Program.cs and expose your business objects via OData endpoints.