# Restricting API use by Barcode PIN & blockInfo field in patron record

**URL:** https://forum.innovativeusers.org/t/restricting-api-use-by-barcode-pin-blockinfo-field-in-patron-record/1921
**Category:** Sierra, Millennium & Encore
**Tags:** sierra-rest-api
**Created:** [July 9, 2024, 5:59pm UTC](https://forum.innovativeusers.org/t/restricting-api-use-by-barcode-pin-blockinfo-field-in-patron-record/1921 "2024-07-09T17:59:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ewright](https://forum.innovativeusers.org/letter_avatar_proxy/v4/letter/e/58f4c7/32.png) [@ewright](https://forum.innovativeusers.org/u/ewright)
#### Post date: [July 9, 2024, 5:59pm UTC](https://forum.innovativeusers.org/t/restricting-api-use-by-barcode-pin-blockinfo-field-in-patron-record/1921/1 "2024-07-09T17:59:06Z")

</div>

Hi,  
A while back I submitted an Idea to [assign granularity to API role permissions](https://ideas.iii.com/forums/951745-ils-sierra/suggestions/47332082-rest-api-security-enhancement-request-assign-gran).

Until that happens… how would libraries use API permissions to restrict access to the public computers by:

- PIN/Barcode
- BlockInfo field

Note:  
We only want to assign the permission via the Patrons Validate role.  
We don’t want to give our vendors access to Patrons Read role (that has too much personal information in it).

Should I submit a specific Idea for a new API permission based on the BlockInfo field?

Thanks,  
Elizabeth

---

<div class="post-metadata">

### Author: ![bgaydos](https://forum.innovativeusers.org/user_avatar/forum.innovativeusers.org/bgaydos/32/1045_2.png) [@bgaydos](https://forum.innovativeusers.org/u/bgaydos)
#### Post date: [July 9, 2024, 6:53pm UTC](https://forum.innovativeusers.org/t/restricting-api-use-by-barcode-pin-blockinfo-field-in-patron-record/1921/2 "2024-07-09T18:53:05Z")

</div>

Maybe the solution is to set up an intermediate server which filters out any sensitive field parameters in the GET query string, so that the URI reads something like

[https://search.starklibrary.org:443/iii/sierra-api/v6/patrons/1342391?fields=blockInfo%2Cbarcodes](https://search.starklibrary.org:443/iii/sierra-api/v6/patrons/1342391?fields=blockInfo%2Cbarcodes)

Authenticating with the PIN is beyond anything I have done in the Sierra API, so I can’t offer any suggestions there.

---

<div class="post-metadata">

### Author: ![wesochuck](https://forum.innovativeusers.org/user_avatar/forum.innovativeusers.org/wesochuck/32/499_2.png) [@wesochuck](https://forum.innovativeusers.org/u/wesochuck)
#### Post date: [July 10, 2024, 3:06pm UTC](https://forum.innovativeusers.org/t/restricting-api-use-by-barcode-pin-blockinfo-field-in-patron-record/1921/3 "2024-07-10T15:06:26Z")

</div>

> [@bgaydos](#):
>
> Maybe the solution is to set up an intermediate server which filters out any sensitive field parameters in the GET query string

We use cloudflare for something like this on the Polaris side. It offers tons of flexibility in terms of pinpointing the exact strings you want to block that you can combine with source IPs, countries, and tons of other signals. I believe that can all be done with their free account. We use their pro plan which is $20 a month.

Implementing cloudflare is a significant task that takes some time to wrap your head around, but once you have it in place you quickly come to appreciate the flexibility and extra security it offers you.