/<module>/:record/link/:link_name/add_record_list/:remote_id POST
Overview
    Creates relationships to pre-existing record from a record list.
URL Arguments
Name
Type
Description
Required
            <record ID>

            <string>

            Target record ID.

            True.

            <report ID>

            <string>

            Report ID for Saved Report.

            True.

            <relationship link>

            <string>

            Link between targeted and related records.

            True.

Request
Response Arguments
Name
Type
Description
            record

            Array

            The record linked to related records.

            related_records

            Array

            Record IDs that were associated.

Response
    "record": {
        "id": "da6a3741-2a81-ba7f-f249-512d0932e94e",
        "name": "Slender Broadband Inc - 1000 units",
        "date_entered": "2013-02-26T19:12:00+00:00",
        "date_modified": "2013-02-26T19:12:00+00:00",
        "modified_user_id": "1",
        "modified_by_name": "Administrator",
        "created_by": "1",
        "created_by_name": "Administrator",
        "description": "",
        "img": "",
        "last_activity_date": "2013-02-28T18:21:00+00:00",
        "deleted": false,
        "assigned_user_id": "seed_max_id",
        "assigned_user_name": "Max Jensen",


"assigned_user_name": "Max Jensen",
        "team_name": [
            {
                "id": "East",
                "name": "East",
                "name_2": "",
                "primary": false
            },
            {
                "id": "West",
                "name": "West",
                "name_2": "",
                "primary": true
            }
        ],
        "opportunity_type": "",
        "account_name": "Slender Broadband Inc",
        "account_id": "181461c6-dc81-1115-1fe0-512d092e8f15",
        "campaign_id": "",
        "campaign_name": "",
        "lead_source": "Campaign",
        "amount": "25000",
        "base_rate": "1",
        "amount_usdollar": "25000",
        "currency_id": "-99",
        "currency_name": "",
        "currency_symbol": "",
        "date_closed": "2013-02-27",
        "date_closed_timestamp": "1361992480",
        "next_step": "",
        "sales_stage": "Needs Analysis",
        "sales_status": "New",
        "probability": "90",
        "best_case": "25000",
        "worst_case": "25000",
        "commit_stage": "include",
        "my_favorite": false,
        "_acl": {
            "fields": {
            }
        }
    },
    "related_records": [
        success: [
            "e689173e-c953-1e14-c215-512d0927e7a2",


"da6a3741-2a81-ba7f-f249-512d0932e94e",
            "181461c6-dc81-1115-1fe0-512d092e8f15"
        ],
        error: []
    ]
}
Change Log
Version
Change
            v10 (7.2.0)

            Added /<module>/:record/link/:link_name/add_record_list/:remote_id POST endpoint.

  	Last modified: 2023-02-03 21:04:03


/metadata/<module>/:segment GET
Overview
[ADMIN] Gets the desired segment for a given module.
Summary
Gets the desired segment for a given module. This is used only for modules that are not visible and thus not in metatdata for the given context. This endpoint is only available to administrators.
Request Arguments
This endpoint does not accept any request arguments.
Response
{
    "fields": {
        Any fields associated with the module
    }
}
Change Log
Version
Change
v11_11
Added /metadata/<module>/:segmentÂ GET endpoint.
  	Last modified: 2023-02-03 21:04:03


/ConsoleConfiguration/config POST
Overview
Saves configuration changes in the database.
Request Arguments
This endpoint does not accept any request arguments.
URL Example
/rest/v11_9/ConsoleConfiguration/config
Request Payload Example
{
   "is_setup":true,
   "enabled_modules":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":[
     	    "Cases"
  	],
  	"da438c86-df5e-11e9-9801-3c15c2c53980":[
     	    "Accounts",
     	    "Opportunities"
  	]
   },
   "order_by_primary":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
     	    "Cases":"follow_up_datetime:asc"
  	},
  	"da438c86-df5e-11e9-9801-3c15c2c53980":{
     	    "Accounts":"next_renewal_date:asc",
     	    "Opportunities":"date_closed:asc"
  	}
   },
   "order_by_secondary":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
     	    "Cases":""
  	},
  	"da438c86-df5e-11e9-9801-3c15c2c53980":{
     	    "Accounts":"",
     	"Opportunities":""
  	}
   },
   "filter_def":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":{


"Cases":[
        	        {
           	            "status":{
              	    "$not_in":[
                 	        "Closed",
                 	        "Rejected",
                 	        "Duplicate"
              	    ]
           	            }
        	        },
        	        {
           	"$owner":""
        	        }
     	    ]
  	},
  	"da438c86-df5e-11e9-9801-3c15c2c53980":{
     "Accounts":[
        	{
           	    "$owner":""
        	}
     ],
     "Opportunities":[
        	{
           	    "sales_status":{
              	"$not_in":[
                 	    "Closed Won",
                 	    "Closed Lost"
              	]
           	    }
        	},
        	{
           	"$owner":""
        	}
     ]
  	}
   },
   "defaults":{
  	"is_setup":0,
  	"enabled_modules":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":[
        	    "Cases"
     		],
     	"da438c86-df5e-11e9-9801-3c15c2c53980":[
        	    "Accounts",
        	    "Opportunities"
     	]
  	},
  	"order_by_primary":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
        	    "Cases":"follow_up_datetime:asc"
     	},
     	"da438c86-df5e-11e9-9801-3c15c2c53980":{


"Accounts":"next_renewal_date:asc",
        	    "Opportunities":"date_closed:asc"
     	}
  	},
  	"order_by_secondary":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
        	    "Cases":""
     	},
     	"da438c86-df5e-11e9-9801-3c15c2c53980":{
        	    "Accounts":"",
        	    "Opportunities":""
     	}
  	},
  	"filter_def":{
     	    "c108bb4a-775a-11e9-b570-f218983a1c3e":{
        	"Cases":[
           	    {
              	"status":{
                 	    "$not_in":[
                    	        "Closed",
                    	        "Rejected",
                    	        "Duplicate"
                 	    ]
              	}
           	    },
           	    {
              	"$owner":""
           	    }
        	]
     	    },
     	    "da438c86-df5e-11e9-9801-3c15c2c53980":{
        	        "Accounts":[
           	            {
              	    "$owner":""
           	            }
        	        ],
        	        "Opportunities":[
           	            {
              	    "sales_status":{
                 	        "$not_in":[
                    	            "Closed Won",
                    	            "Closed Lost"
                 	        ]
              	    }
           	            },
           	            {
              	    "$owner":""
           	            }
        	        ]
     	    }
          }
   },
   "labels":{
  	"Cases":[
     	    {


},
   "labels":{
  	"Cases":[
     	    {
        	"label":"LBL_LIST_PRIORITY/LBL_STATUS",
        	"labelValue":"Priority/Status"
     	    },
     	    {
        	        "label":"LBL_LIST_SUBJECT/LBL_SERVICE_LEVEL",
        	        "labelValue":"Subject/Service Level"
     	    }
  	]
   },
   "viewdefs":{
      "Cases":{
     	"base":{
        	    "view":{
           	        "multi-line-list":{
              	"panels":[
                 	    {
                    	        "label":"LBL_LABEL_1",
                    	        "fields":[
                       	            {
                          	    "name":"case_number",
                          	    "label":"LBL_AGENT_WORKBENCH_NUMBER",
                          	    "subfields":[
                             	        {
                                	            "default":true,
                                	            "enabled":true,
                                      	"name":"case_number",
                                    	"label":"LBL_AGENT_WORKBENCH_NUMBER"
                             	        }
                          	    ]
                       	            },
                       	            {
                          	    "name":"Priority/Status",
                          	    "label":"LBL_LIST_PRIORITY/LBL_STATUS",
                          	    "subfields":[
                             	        {
                                	            "default":true,
                                	            "enabled":true,
                                	            "name":"priority",
                                	            "label":"LBL_LIST_PRIORITY",
                                	            "type":"enum"
                             	        },
                             	        {
                                	            "default":true,
                                	            "enabled":true,
                                	            "name":"status",
                                	            "label":"LBL_STATUS",
                                	            "type":"case-status",
                                	            "widget_name":"widget_status"
                             	        }
                          	    ]
                       	            },
                       	            {


}
                          	    ]
                       	            },
                       	            {
                          	    "name":"Subject/Service Level",
                          	    "label":"LBL_LIST_SUBJECT/LBL_SERVICE_LEVEL",
                          	    "subfields":[
                             	        {
                                	            "default":true,
                                	            "enabled":true,
                                	            "name":"name",
                                	            "label":"LBL_LIST_SUBJECT",
                                	            "link":false
                             	        },
                             	        {
                                	            "default":true,
                                	            "enabled":true,
                                	            "name":"service_level",
                                	            "label":"LBL_SERVICE_LEVEL",
                                	            "type":"enum",
                                	            "enum_module":"Accounts",
                                	            "link":false
                             	        }
                          	    ]
                       	            }
                    	    ]
                       }
                    ],
                    "collectionOptions":{
                 	"limit":100,
                 	"params":{
                    	    "max_num":100,
                    	    "order_by":"follow_up_datetime",
                    	    "nulls_last":true
                 	}
                    },
                    "filterDef":[
                 	{
                    	    "status":{
                       	        "$not_in":[
                          	"Closed",
                          	"Rejected",
                          	"Duplicate"
                       	        ]
                    	    },
                    	    "$owner":""
                 	}
                    ]
           	      }
        	   }
     	}
      }
   }
}
Response Arguments
Response
{
   "is_setup":1,
   "enabled_modules":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":[
     	"Cases"
  	],


"Cases"
  	],
  	"da438c86-df5e-11e9-9801-3c15c2c53980":[
     	"Accounts",
     	"Opportunities"
  	]
   },
   "order_by_primary":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
     	"Cases":"follow_up_datetime:asc"
  	},
  	"da438c86-df5e-11e9-9801-3c15c2c53980":{
     	"Accounts":"next_renewal_date:asc",
     	"Opportunities":"date_closed:asc"
  	}
   },
   "order_by_secondary":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
     	"Cases":""
  	},
  	"da438c86-df5e-11e9-9801-3c15c2c53980":{
     	"Accounts":"",
     	"Opportunities":""
  	}
   },
   "filter_def":{
  	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
     	"Cases":[
        	{
           	"status":{
              	"$not_in":[
                 	"Closed",
                 	"Rejected",
                 	"Duplicate"
              	]
           	}
        	},
        	{
           	"$owner":""
        	}
     	]
  	},


"$owner":""
        	}
     	]
  	},
  	"da438c86-df5e-11e9-9801-3c15c2c53980":{
     	"Accounts":[
        	{
           	"$owner":""
        	}
     	],
     	"Opportunities":[
        	{
           	"sales_status":{
              	"$not_in":[
                 	"Closed Won",
                 	"Closed Lost"
              	]
           	}
        	},
        	{
           	"$owner":""
        	}
     	]
  	}
   },
   "defaults":{
  	"is_setup":0,
  	"enabled_modules":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":[
        	"Cases"
     	],
     	"da438c86-df5e-11e9-9801-3c15c2c53980":[
        	"Accounts",
        	"Opportunities"
     	]
  	},
  	"order_by_primary":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
        	"Cases":"follow_up_datetime:asc"
     	},
     	"da438c86-df5e-11e9-9801-3c15c2c53980":{
        	"Accounts":"next_renewal_date:asc",
        	"Opportunities":"date_closed:asc"
     	}
  	},
  	"order_by_secondary":{


}
  	},
  	"order_by_secondary":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
        	"Cases":""
     	},
     	"da438c86-df5e-11e9-9801-3c15c2c53980":{
        	"Accounts":"",
        	"Opportunities":""
     	}
  	},
  	"filter_def":{
     	"c108bb4a-775a-11e9-b570-f218983a1c3e":{
        	"Cases":[
           	{
              	"status":{
                 	"$not_in":[
                    	"Closed",
                    	"Rejected",
                    	"Duplicate"
                 	]
              	}
           	},
           	{
              	"$owner":""
           	}
        	]
     	},
     	"da438c86-df5e-11e9-9801-3c15c2c53980":{
        	"Accounts":[
           	{
              	"$owner":""
           	}
        	],
        	"Opportunities":[
           	{
              	"sales_status":{
                 	"$not_in":[
                    	"Closed Won",
                    	"Closed Lost"
                 	]
              	}
           	},
           	{
              	"$owner":""
           	}
        	]
     	}
  	}
   }
}
Response Codes and Error Messages
This API does not return new errors other than the ones that may be returned by its parent API - ConfigModule API. The following error responses are possible:


403 (SugarAPIExceptionNotAuthorized) : Sent if the user attempts to access a module that they are forbidden to access.
Change Log
Version
Change
v11.9
Added /ConsoleConfiguration/config POST endpoint.
  	Last modified: 2023-02-03 21:04:03


/<module>/:record/link/:link_name/leancount GET
Overview
    Lists related filtered records.
Summary
    This endpoint will return a set of related records filtered by an expression. The filter can be applied to multiple
    fields and have multiple and/or conditions in it. Care will need to be taken to make sure this filter has
    appropriate indexes on the server side otherwise the runtime of the endpoint will be very long. Related fields can
    be searched by specifying the field name as: "link_name.remote_field", so if you wished to search the Accounts
    module by a related member account you would use "members.sic_code".
Request Arguments
Name
Type
Description
Required
            filter

            String

            The filter expression. Filter expressions are explained below.

            False

            max_num

            Integer

            A maximum number of records to return. Default is 20.

            False

            offset

            Integer

            The number of records to skip over before records are returned. Default is 0.

            False

            fields

            String

            Comma delimited list of fields to return. The field date_modified will always be returned. This argument
            can be combined with the view argument.

            Example: name,account_type,description
            False

            view

            String

            Instead of defining the fields argument, the view argument can be used instead. The field list is
            constructed at the server side based on the view definition which is requested. This argument can be used
            in combination with the fields argument. Common views are "record" and "list".

            Example: record
            False

            order_by

            String


False

            order_by

            String

            How to sort the returned records, in a comma delimited list with the direction appended to the column name
            after a colon.

            Example: name:DESC,account_type:DESC,date_modified:ASC
            False

Filter Expressions
There are four types of filters:
Basic
    This will filter the results by checking the field "name" for value "Nelson Inc". This will only find exact matches.
    Example
{
   "filter":[
      {
         "name":"Nelson Inc"
      }
   ]
}
Full
    This expression allows you to specify what operation you want to use for filtering on the field. In the example you
    would match any record where the field "name" starts with the value "Nelson".
    Example
{
   "filter":[
      {
         "name":{
            "$starts":"Nelson"
         }
      }
   ]
}
        Below is a list of operation types:

Operation
Description
                $equals

                Performs an exact match on that field.

                $not_equals

                Performs an exact match on that field.

                $not_equals

                Matches on non-matching values.

                $starts

                Matches on anything that starts with the value.

                $ends

                Matches anything that ends with the value.

                $contains

                Matches anything that contains the value

                $in

                Finds anything where field matches one of the values as specified as an array.

                $not_in

                Finds anything where field does not matches any of the values as specified as an array.


$is_null

                Checks if the field is null. This operation does not need a value specified.

                $not_null

                Checks if the field is not null. This operation does not need a value specified.

                $lt

                Matches when the field is less than the value.

                $lte

                Matches when the field is less than or equal to the value.

                $gt

                Matches when the field is greater than the value.

                $gte

                Matches when the field is greater than or equal to the value.

Sub-expressions
    This allows you to group filter expressions into or/and groupings. By default all expressions are and'ed together.
    The example expression would match if the field "name" was either "Nelson Inc" or "Nelson LLC". The only currently
    accepted sub-expression types are "$and" and "$or".
    Example
{
   "filter":[
      {
         "$or":[
            {
               "name":"Nelson Inc"
            },
            {
               "name":"Nelson LLC"
            }
         ]
      }
   ]
}
Modules
    There are two module expressions, they operate on modules instead of fields. The current module can be specified by
    either using the module name "_this" or by leaving the module name as a blank string. The example expression would
    filter the records in the current module to only your favorites. The only currently accepted module expressions are
    "$favorite" and "$owner".
    Example
{
   "filter":[
      {
         "$favorite":"_this"
      }
   ]
}
Response Arguments
Name
Type
Description
            next_offset


]
}
Response Arguments
Name
Type
Description
            next_offset

            Integer

            Displays the next offset for retrieval of additional results. -1 will be returned when there are no more
            records.

            records

            Array

            An array of results containing matched records.

Repsonse
{
   "next_offset":-1,
   "records":[
      {
         "id":"fa300a0e-0ad1-b322-9601-512d0983c19a",
         "name":"Dale Spivey",
         "date_entered":"2013-02-26T19:12:00+00:00",
         "date_modified":"2013-02-28T05:03:00+00:00",
         "modified_user_id":"1",
         "modified_by_name":"Administrator",
         "created_by":"1",
         "created_by_name":"Administrator",
         "description":"",
         "img":"",
         "deleted":false,
         "assigned_user_id":"seed_sally_id",
         "assigned_user_name":"Sally Bronsen",
         "team_name":[
            {
               "id":"East",
               "name":"East",
               "name_2":"",
               "primary":false
            },
            {
               "id":1,
               "name":"Global",
               "name_2":"",
               "primary":false
            },
            {
               "id":"West",
               "name":"West",
               "name_2":"",
               "primary":true
            }
         ],
         "salutation":"",
         "first_name":"Dale",
         "last_name":"Spivey",


"first_name":"Dale",
         "last_name":"Spivey",
         "full_name":"Dale Spivey",
         "title":"VP Operations",
         "linkedin":"",
         "facebook":"",
         "twitter":"",
         "googleplus":"",
         "department":"",
         "do_not_call":false,
         "phone_home":"(523) 825-4311",
         "email":[
            {
               "email_address":"sugar.dev.sugar@example.co.jp",
               "opt_out":"0",
               "invalid_email":"0",
               "primary_address":"1"
            },
            {
               "email_address":"the.support@example.biz",
               "opt_out":"0",
               "invalid_email":"0",
               "primary_address":"0"
            }
         ],
         "phone_mobile":"(373) 861-0757",
         "phone_work":"(212) 542-9596",
         "phone_other":"",
         "phone_fax":"",
         "email1":"sugar.dev.sugar@example.co.jp",
         "email2":"the.support@example.biz",
         "invalid_email":false,
         "email_opt_out":false,
         "primary_address_street":"345 Sugar Blvd.",
         "primary_address_street_2":"",
         "primary_address_street_3":"",
         "primary_address_city":"Denver",
         "primary_address_state":"CA",
         "primary_address_postalcode":"87261",
         "primary_address_country":"USA",
         "alt_address_street":"",
         "alt_address_street_2":"",
         "alt_address_street_3":"",
         "alt_address_city":"",
         "alt_address_state":"",
         "alt_address_postalcode":"",


"alt_address_state":"",
         "alt_address_postalcode":"",
         "alt_address_country":"",
         "assistant":"",
         "assistant_phone":"",
         "picture":"",
         "email_and_name1":"",
         "lead_source":"Campaign",
         "account_name":"Smallville Resources Inc",
         "account_id":"d5db6292-5c24-eb61-e202-512d09f0134e",
         "opportunity_role_fields":"",
         "opportunity_role_id":"",
         "opportunity_role":"",
         "reports_to_id":"",
         "report_to_name":"",
         "portal_name":"DaleSpivey97",
         "portal_active":true,
         "portal_password":"$1$yKMAONHM$Y5S.8CY.WZCZCwfGD1a1Q\/",
         "portal_password1":"",
         "portal_app":"",
         "preferred_language":"en_us",
         "campaign_id":"",
         "campaign_name":"",
         "c_accept_status_fields":"",
         "m_accept_status_fields":"",
         "accept_status_id":"",
         "accept_status_name":"",
         "sync_contact":"",
         "my_favorite":false,
         "_acl":{
            "fields":{
            }
         }
      },
      {
         "id":"95e17367-9b3d-0e26-22dc-512d0961fedf",
         "name":"Florence Haddock",
         "date_entered":"2013-02-26T19:12:00+00:00",
         "date_modified":"2013-02-26T19:12:00+00:00",


"modified_user_id":"1",
         "modified_by_name":"Administrator",
         "created_by":"1",
         "created_by_name":"Administrator",
         "description":"",
         "img":"",
         "deleted":false,
         "assigned_user_id":"seed_sally_id",
         "assigned_user_name":"Sally Bronsen",
         "team_name":[
            {
               "id":"East",
               "name":"East",
               "name_2":"",
               "primary":false
            },
            {
               "id":1,
               "name":"Global",
               "name_2":"",
               "primary":false
            },
            {
               "id":"West",
               "name":"West",
               "name_2":"",
               "primary":true
            }
         ],
         "salutation":"",
         "first_name":"Florence",
         "last_name":"Haddock",
         "full_name":"Florence Haddock",
         "title":"Director Sales",
         "linkedin":"",
         "facebook":"",
         "twitter":"",
         "googleplus":"",
         "department":"",
         "do_not_call":false,
         "phone_home":"(729) 845-3137",
         "email":[
            {
               "email_address":"dev.vegan@example.de",
               "opt_out":"1",
               "invalid_email":"0",
               "primary_address":"0"
            },
            {
               "email_address":"section71@example.it",
               "opt_out":"0",
               "invalid_email":"0",
               "primary_address":"1"
            }
         ],
         "phone_mobile":"(246) 233-1382",


],
         "phone_mobile":"(246) 233-1382",
         "phone_work":"(565) 696-6981",
         "phone_other":"",
         "phone_fax":"",
         "email1":"section71@example.it",
         "email2":"dev.vegan@example.de",
         "invalid_email":false,
         "email_opt_out":false,
         "primary_address_street":"111 Silicon Valley Road",
         "primary_address_street_2":"",
         "primary_address_street_3":"",
         "primary_address_city":"Denver",
         "primary_address_state":"CA",
         "primary_address_postalcode":"79900",
         "primary_address_country":"USA",
         "alt_address_street":"",
         "alt_address_street_2":"",
         "alt_address_street_3":"",
         "alt_address_city":"",
         "alt_address_state":"",
         "alt_address_postalcode":"",
         "alt_address_country":"",
         "assistant":"",
         "assistant_phone":"",
         "picture":"",
         "email_and_name1":"",
         "lead_source":"Support Portal User Registration",
         "account_name":"Smallville Resources Inc",
         "account_id":"d5db6292-5c24-eb61-e202-512d09f0134e",
         "opportunity_role_fields":"",
         "opportunity_role_id":"",
         "opportunity_role":"",
         "reports_to_id":"",
         "report_to_name":"",
         "portal_name":"FlorenceHaddock169",
         "portal_active":true,
         "portal_password":"$1$nWFhTbK6$JF9BCGSqL\/NCrbhueX5ia0",


"portal_password1":"",
         "portal_app":"",
         "preferred_language":"en_us",
         "campaign_id":"",
         "campaign_name":"",
         "c_accept_status_fields":"",
         "m_accept_status_fields":"",
         "accept_status_id":"",
         "accept_status_name":"",
         "sync_contact":"",
         "my_favorite":false,
         "_acl":{
            "fields":{
            }
         }
      }
   ]
}
Change Log
Version
Change
            v10

            Added /<module>/:record/link/:link_name/filter GET endpoint.

  	Last modified: 2023-02-03 21:04:03


/search GET
Overview
    List records in a module. Searching, filtering and ordering can be applied to only fetch the records you are interested in. Additionally the set of returned fields can be restricted to speed up processing and reduce download times.
Request Arguments
Name
Type
Description
Required
                q

                String

                The search text to match records on. This will search through any fields on the module that has unified_search set to true.

                False

                max_num

                Integer

                A maximum number of records to return.

                False

                offset

                Integer

                The number of records to skip over before records are returned.

                False

                fields

                String

                Comma delimited list of fields to return. The field date_modified will always be returned.

                Example: name,account_type,description
                False

                order_by

                String

                How to sort the returned records, in a comma delimited list with the direction appended to the column name after a colon.

                Example: name:DESC,account_type:DESC,date_modified:ASC
                False

                favorites

                Boolean

                Only fetch the current users favorited records.

                False

                my_items

                Boolean

                Only fetch items assigned to the current user.

                False

Response Arguments
Name
Type
Description
                next_offset

                Integer

                Displays the next offset for retrieval of additional results. -1 will be returned when there are no more records.

                records

                Array

                An array of results containing matched records.

Response
{


An array of results containing matched records.

Response
{
   "next_offset":2,
   "records":[
      {
         "id":"ecbf2a6c-261e-5fca-fbb6-512d093554b8",
         "name":"Avery Software Co",
         "date_modified":"2013-02-26T19:12:56+00:00",
         "description":"",
         "my_favorite":false,
         "_acl":{
            "fields":{
            }
         },
         "_module":"Accounts",
         "_search":{
            "score":1
         }
      },
      {
         "id":"af5f8dae-7169-b497-1d77-512d0937ed81",
         "name":"Avery Software Co",
         "date_modified":"2013-02-26T19:12:56+00:00",
         "description":"",
         "my_favorite":false,
         "_acl":{
            "fields":{
            }
         },
         "_module":"Accounts",
         "_search":{
            "score":1
         }
      }
   ]
}
Change Log
Version
Change
            v10

            Added /<module> GET endpoint.

  	Last modified: 2023-02-03 21:04:03


/Forecasts/user/:user_id GET
ForecastsApi - user
Summary:
    This endpoint is used to return a user's id, user_name, full_name, first_name, last_name, and is_manager param given a user's id.
Query Parameters:
Param
Description
Optional
user_id
Returns user data for this specific user id
Â
Input Example:
        {
        user_id:seed_sally_id
        }

Output Example:
        {
            first_name: "Sally"
            full_name: "Sally Bronsen"
            id: "seed_sally_id"
            is_manager: false
            last_name: "Bronsen"
            user_name: "sally"
        }

  	Last modified: 2023-02-03 21:04:03


/<module>/append/:target POST
Overview
    Append new node to target node as last child.
Request Arguments
Name
Type
Description
Required
                module

                String

                The name of sugar module that contains a nested set data and implements the NestedSetInterface.

                True

                target

                String

                The ID of record that will be used as target to append new node

                True

Request
{
    "name" : "Children Node 1"
}
Response Arguments
    This endpoint does not return any response arguments.
Response
This endpoint returns a newly created bean
    {
        "my_favorite":false,
        "following":"",
        "id":"59fa8dd7-0f2c-4bfd-364f-54495f77fa3f",
        "name":"Default title",
        "date_entered":"2014-10-23T23:03:22+03:00",
        "date_modified":"2014-10-23T23:03:22+03:00",
        "modified_user_id":"1",
        "modified_by_name":"Administrator",
        "created_by":"1",
        "created_by_name":"Administrator",
        "doc_owner":"",
        "description":"",
        "deleted":false,
        "source_id":"",
        "source_type":"",
        "source_meta":"",
        "root":"be9b0c4a-8b78-1ffa-4f14-54481c2f6269",
        "lft":118,
        "rgt":119,
        "level":1,
        "_acl":{"fields":{}},
        "_module":"Categories"
    }
Change Log


"_module":"Categories"
    }
Change Log
Version
Change
            v10

            Added /<module>/append/:target POST endpoint.

  	Last modified: 2023-02-03 21:04:03


/theme GET
Overview
    Fetches the customizable variables of a theme.
Request Arguments
Name
Type
Description
Required
platform
String
The theme platform - /themes/clients/***PLATFORM***/themeName/. Accepted values are 'base' and 'portal'.
False
themeName
String
The theme name - /themes/clients/platform/***THEME NAME***/.
False
Request
http://{site_url}/rest/v10/theme?platform=base&themeName=default
Note: GET endpoint parameters are passed in the form of a query string.
Response Arguments
Name
Type
Description
mixins
Array
An array of name value pairs detailing mixin colors
hex
Array
A array of name value pairs detailing css colors
rgba
Array
An array of name value pairs detailing colors
rel
Array
An array of name value pairs detailing relationships
bg
Array
An array of name value pairs detailing backgroup colors
Response
{
   "colors":[
      {
         "name":"BorderColor",
         "value":"#E61718"
      },
      {
         "name":"NavigationBar",
         "value":"#000000"
      },
      {
         "name":"PrimaryButton",
         "value":"#177EE5"
      }
   ]
}
Change Log
Version
Change
            v10

            Added /<theme> GET endpoint.

  	Last modified: 2023-02-03 21:04:03


/Forecasts/:timeperiod_id/progressRep/:user_id GET
Projected Rep Data
Summary:
    This endpoint is used to return the json Data not already in client view for the Forecasts rep projected panel.
Query Parameters:
Param
Description
Optional
user_id
Show for a specific user, defaults to current user if not defined
Optional
timeperiod_id
Show for a specific time period, defaults to the current time period if one is not passed
Optional
Input Example:
{
    user_id:seed_sally_id
    timeperiod_id:36f7085a-5889-ea75-84c8-50f42bd1a5ba
}

Output Example:
{
       quota_amount: "80000.000000"
}

  	Last modified: 2023-02-03 21:04:03


/pmse_Inbox/unattendedCases GET
Overview
    Retrieves the processes to show on Unattended Process view
Summary
    This endpoint gets the list of unattended processes
Request Arguments
Name
Type
Description
Required
module_list
string
Identifier used to determine which field to filter against
true
q
string
Filter applied to a field to determine which processes to return
false
order_by
string
Sort definition to apply to the result
false
Response Arguments
Name
Type
Description
next_offset
integer
Next offset for more results
records
<field>:<value>
List of unattended process attributes
Response
{
    "next_offset":"-1",
    "records":
    [
        {
            "id":"3922976c-284f-11e6-9f40-6c4008960436",
            "assigned_user_id":"1",
            "date_modified":"2016-06-01 23:18:59",
            "date_entered":"2016-06-01T16:18:59-07:00",
            "name":"ABC2",
            "cas_id":"2",
            "cas_title":"ABC2",
            "cas_status":"IN PROGRESS",
            "pro_title":"PD1",
            "pro_id":"6e172e2c-2842-11e6-a4bb-6c4008960436",
            "cas_init_user":"1",
            "cas_user_full_name":"Sarah Smith",
            "prj_id":"6e025038-2842-11e6-b4f7-6c4008960436",
            "prj_user_id_full_name":"Administrator",


"prj_user_id_full_name":"Administrator",
            "cas_sugar_object_id":"38beb03a-284f-11e6-b059-6c4008960436",
            "cas_sugar_module":"Accounts",
            "assigned_user_name":"Administrator"
        }
    ]
}
  	Last modified: 2023-02-03 21:04:03


Security
Security documents for securing SugarsÂ infastructure.
TopicsEndpoints and Entry PointsThis document describes how to disable out of the box REST API endpoints and legacy MVC entry points.Web Server ConfigurationThis document serves as a guideline to harden the web server configuration with regard to running SugarCRM. Note that this is a guideline and certain settings will depend on your specific environment and setup. This guideline focuses on Apache web server as this is SugarCRM's primary supported web server. However, the recommendations in this document apply to all web servers in general.XSS PreventionThis document describes how to prevent cross-site scripting (XSS) attacks in Sugar customizations. XSS attacks occur when malicious entities are able to inject client-side scripts into web pages.
  	Last modified: 2023-02-03 21:04:03


Endpoints and Entry Points
Overview
This document describes how to disable out of the box REST API endpoints and legacy MVC entry points.
Advisory ID: sugarcrm-sr-2015-001Revision: 1.1Last updated: 2015-10-01
Description
SugarCRM has both legacy entry points and REST API endpoints which are shipped out of the box. Not every customer uses all capabilities of the SugarCRM product. To harden the configuration both entry points can be disabled based on the customer's requirements.
Legacy Entry Points
All stock entry points are defined in include/MVC/Controller/entry_point_registry.php. Using the SugarCRM Extension framework the configuration directives can be overridden in an upgrade safe manner. As an example consider the entrypoint "removeme". To disable this entrypoint use the following procedure.
Create a new php file ./custom/Extension/application/Ext/EntryPointRegistry/disable_removeme.php and add the following content:
<?php
if (isset($entry_point_registry['removeme'])) {
    unset($entry_point_registry['removeme']);
}
Execute a quick repair and rebuild as SugarCRM administrator. The entry point is now fully disabled and no longer accessible to respond to any calls. Note that when trying to hit an non-existing (or disabled) entry point, the application will redirect you to the homepage (or login screen if the user has no session).
REST API Endpoints
To disable the HelpAPI which is located at clients/base/api/HelpApi.php use the following procedure.
Create a new php file custom/clients/base/api/CustomHelpApi.php and add the following content:
<?php
require_once 'clients/base/api/HelpApi.php';
class CustomHelpApi extends HelpApi
{
    public function getHelp($api, $args)
    {
        throw new SugarApiExceptionNotFound();
    }
}


{
        throw new SugarApiExceptionNotFound();
    }
}
Execute a quick repair and rebuild as SugarCRM administrator. The entry point is now fully disabled. When making a REST API call to /rest/v10/help the followingHTTP 404 Not FoundÂ error will be returned:
{
    "error": "not_found",
    "error_message": "Your requested resource was not found."
}
Publication History
2015-10-01
Adding REST API endpoint example
2015-06-16
Initial publication
A stand-alone copy of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. SugarCRM reserves the right to change or update this document at any time.
  	Last modified: 2023-02-03 21:04:03


XSS Prevention
Overview
This document describes how to prevent cross-site scripting (XSS) attacks in Sugar customizations. XSS attacks occur when malicious entities are able toÂ inject client-side scripts into web pages.
Best Practices
When creating custom code for Sugar, be sure to respect the followingÂ best practices. These rules serve to protect the elements of your customizations that are most susceptible to XSS vulnerabilities:
Create safe variables when injecting HTML via Handlebars templates or JavaScript methods such as: $(selector).html(variable), $(selector).before(variable), or $(selector).after(variable).
Avoid using triple-bracket (e.g.Â {{{variable}}}) syntax to allow unescaped HTML content in Handlebars templates.
Never use input from an unknown source as it may contain unsafe data.
Protect dynamic content, which may also contain unsafe data.
Please refer to the following sections for more information and examples that demonstrate these best practices.
Creating Safe Variables
You must always encode a variable before you inject or display it on a webpage. The piece that is not encoded should be isolated and marked as a safe string very carefully. The the following sections outline protectingÂ your system when using JavaScriptÂ and Handlebars templates.
JavaScript
To ensure displayedÂ JavaScript variables are safe, respect these two rules:
If you are displaying plainÂ text without any HTML, use .text() instead of .html()Â with your selectors.
If your text contains HTML formatting, you can use .html()Â as long as it does not contain any dynamic data coming from a variable.
Vulnerable Setup
This is an example of bad code because it utilizes theÂ .html()Â method to display a dynamic-value variable, leaving the JavaScript vulnerable to injection:
var inputData = $('#myInput').val(); // "<script>alert(0)</script>"


var inputData = $('#myInput').val(); // ""
$(selector).html('This is the value: ' + inputData); // "This is the value: "
Protected Setup
This isÂ an example of good code, which uses the safe .text() method to protect the JavaScript from potential injection:
var status = 'safe';
$(selector).text('This is very ' + status); // "This is very safe"
This is also an acceptable approach, which uses theÂ Handlebars.Utils.escapeExpression to safely escape the content:
var inputData = $('#myinput').val(); // ""
var safeData = Handlebars.Utils.escapeExpression(inputData); // "<script>alert(0)</script>"
$(selector).html('This is the value: ' + safeData); // "This is the value: <script>alert(0)</script>"
Handlebars Templates
Handlebars, by default, handles the encoding of data passed to the template in double brackets (e.g. {{variable}}), however, it also allows you to bypass this encoding by using triple brackets (e.g. {{{variable}}}). Text passed via triple brackets will not be encoded. As a rule, do not use triple brackets. If you don't want Handlebars to encode a piece of a string, use double bracketsÂ and execute Handlebars.SafeString() in your JavaScript controller.Â
As anÂ example, we will apply best practices to a complex use case with dynamicÂ values thatÂ need to be encoded. For this example, weÂ want to displayÂ a message similar to:
Congrats! You just created the record ABCD


The values ABCD and /#Accounts/abcd are dynamic values and, therefore, must be encoded. But the message must also be displayed as HTML, so the overall element cannot be entirely encoded. To address this use case, we must properly script the JavaScript controller and the Handlebars template.
The following JavaScript encodes the message's dynamic values, marks the displayed hyperlink as a safe string, and then outputs the safe message:
var record = {
    id: 'abcd',
    name: 'ABCD'
};
// escape `ABCD`
var safeName = Handlebars.Utils.escapeExpression(record.name);
// escape `abcd`
var safeId = Handlebars.Utils.escapeExpression(record.id);
// Mark the link as a SafeString now that the unsafe pieces are encoded and the content has safe HTML.
var link = new Handlebars.SafeString('' + safeName . '');
// This can be displayed with double brackets in the template because html parts will not be encoded.
this.safeMessage = new Handlebars.SafeString('Congrats! You just created the record ' + link + '.');
To display the safe message in the application, use the following syntax in your Handlebars template:

{{safeMessage}}

Please refer to the HTML Escaping documentation on the Handlebars website for more information.Â
  	Last modified: 2023-02-03 21:04:03


Web Server Configuration
Overview
This document serves as a guideline to harden the web server configuration with regard to running SugarCRM. Note that this is a guideline and certain settings will depend on your specific environment and setup. This guideline focuses on Apache web server as this is SugarCRM's primary supported web server. However, the recommendations in this document apply to all web servers in general.
Advisory ID: sugarcrm-sr-2015-003Revision: 1.1Last updated: 2015-10-01Â
SugarCRM .htaccess file
During installation, SugarCRM deploys an .htaccess file in SugarCRM's root folder. The content of this file may change during upgrades as well. The primary configuration directives managed by SugarCRM are focused around disabling direct access to certain directories and files. Secondly, the configuration contains specific URL rewrite rules which are required for SugarCRM.
Although this file can be used to ship most of the settings which are explained in this document to harden the web server, SugarCRM has chosen not to do so as most of them depend on the customer's setup which cannot be fully controlled by the SugarCRM application itself.
All directives which are managed by SugarCRM are placed between the following markers inside the .htaccess file:
# BEGIN SUGARCRM RESTRICTIONS
RedirectMatch 403 .*\.log$
...
# END SUGARCRM RESTRICTIONS
Customers can add additional directives if need. Make sure to put those directives outside of the above-mentioned markers. SugarCRM can rebuild during upgrades all directives enclosed in the above markers.
Securing .htaccess
Apache allows admins to drop in .htaccess files in any given directory. When a request comes in, Apache will scan the directory recursively for any .htaccess file and apply its configuration directives. This ability is orchestrated by the AllowOverride directive which is enabled by default on most Apache configurations.


To disable this dynamic Apache configuration behavior, disable AllowOverride and make sure to copy paste the .htaccess file content as well.
<Directory "/var/www/html">
    AllowOverride None
    # BEGIN SUGARCRM RESTRICTIONS
    RedirectMatch 403 .*\.log$
    ...
    # END SUGARCRM RESTRICTIONS
</Directory>
When choosing for this security measure, make sure to verify if any changes have happened in the .htaccess after an upgrade. Those changes need to be applied manually back in the Apache configuration to ensure SugarCRM functions properly. Disabling the .htaccess file support also has a positive impact on the performance as Apache will no longer need to scan for the presence of .htaccess files.
Although Apache does not allow to download .htaccess files, to tighten the security around .htaccess, even more, the following directives can be added:
<Files ".ht*">
    Order deny,allow
    Deny from all
</Files>
Prevent version exposure
By default Apache web server exposes its version and OS details in most *nix distributions in both the HTTP response headers as well as on the default error pages. To prevent this behavior use the following configuration directives:
ServerSignature Off
ServerTokens Prod
Â The exposure of the PHP version can be disabled in your php.ini file. When exposed an X-Powered-By response header will be added containing the PHP version information.
expose_php = Off
Another optionÂ is to unset the header explicitly in the Apache configuration:
<IfModule mod_headers.c>
    Header unset X-Powered-By
</IfModule>


Header unset X-Powered-By
</IfModule>
Note that unsetting the Server header is not possible using this way. The web server will always respond with a Server header containing the string "Apache". If it is desired to remove this header as well, additional modules need to be used for this (i.e. mod_security can do this).
Directory listing and index page
Make sure to configure a default index page which should only be index.php for SugarCRM. This is mostly configured but worth checking. Additional SugarCRM does not require the directory browsing support and this is recommended to be disabled. This can be accomplished by removing Options Indexes and/or completely disable the mod_autoindex module.
Optionally additional Allow/Deny directives can be used to apply access lists to certain directories. It is not recommended to add additional authentication through Apache as SugarCRM already fully manages user authentication. The Allow/Deny directives can still be used to apply any IP access list if required by the customer.
The following example secures the root directory (default configuration), disable directory browsing and an additional IP access list is applied.
DocumentRoot "/var/www/html"
<Directory />
    AllowOverride none
    Order allow,deny
    Deny from all
</Directory>
<Directory "/var/www/html">
    DirectoryIndex index.php
    Options -Indexes
    Order deny,allow
    Allow from 10.0.0.0/8
    Deny from all
</Directory>
Additional Options directives
SugarCRM does not rely on both CGI and SSI and it is recommended to disable this functionality explicitly. Optionally the FollowSymLinks options can also be disabled depending on your directory setup.
<Directory "/var/www/html">
    Options -ExecCGI -Includes -FollowSymLinks
</Directory>
Web server permissions


</Directory>
Web server permissions
Ensure your web server is configured to run as a dedicated non-privileged user. Certain *nix distributions use out of the box the user/group nobody. It is recommended to use a dedicated user/group instead.
User wwwrun
Group www
Ensure the configured user/group have the proper file and directory permissions for SugarCRM. See the installation/upgrade guide for more detailed instructions regarding the required permissions.
Disable unnecessary loadable modules
Apache is pluggable by means of loadable modules. To minimize the chances of becoming a victim of an attack it is recommended to disable all loadable modules which are not needed. SugarCRM recommends the following base Apache modules:
mod_authz_host
mod_dir
mod_expires
mod_rewrite
mod_headers
mod_mime
mod_alias
From an Apache perspective to disable a loadable module, it is sufficient to comment out the LoadModule directives. However certain *nix distribution has additional configuration scripts to manage the loaded Apache modules. Please refer to your *nix distribution for this.
Based on your setup additional Apache modules can be used. When using MPM prefork you will also need mod_php5 and when terminating secure HTTP connection on the web server directly also mod_ssl (see below).
HTTP methods
HTTP uses different methods (verbs) in requests. As per RFC-7231 for HTTP/1.1 different request methods are defined which serve the primary source of the request semantics. The following methods are used by SugarCRM:
For new REST API:
GET
POST
PUT
DELETE
HEAD (*)
OPTIONS (*)
Bootstrap, BWC access, old SOAP/REST API:
GET
POST
(*) Currently not in use, but may be implemented in the future.


GET
POST
(*) Currently not in use, but may be implemented in the future.
The new REST API is accessed using the URL "/rest/vxx/â¦" where xxx represents the API version number. To harden the usage of the additional HTTP methods the following directives can be used for the new REST API endpoint while only allowing GET and POST on the legacy access.
<Directory "/var/www/html">
    <LimitExcept GET POST>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Directory>
<Location "/rest">
    <LimitExcept GET POST PUT DELETE>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Location>
<Location "/api/rest.php">
    <LimitExcept GET POST PUT DELETE>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Location>
Instead of using the Limit directive, an alternative is using mod_allowmethods which is available since Apache 2.4. However this module is flagged as experimental.
Secure HTTP traffic
SugarCRM requires the usage of HTTPS transport without any exception. Depending on your setup you can terminate the secure connection on a separate endpoint (load balancer, dedicated HTTPS termination point) or directly on the web server(s). You will also need a valid private key and X.509 certificate. In most cases, the customer needs to acquire an X.509 certificate through a public certification authority of their choice. For internal deployments, this may not be necessary when a local PKI environment is available.
When terminating the secure connection directly on the Apache web server, mod_ssl is required. A dedicated VirtualHost needs to be configured on port 443 (standard HTTPS port). The following is a basic SSL/TLS configuration as a reference. More details are covered in the next paragraphs.


<VirtualHost 1.2.3.4:443>
    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/example.com.crt
    SSLCertificateKeyFile /etc/pki/tls/certs/example.com.key
    SSLCertificateChainFile /etc/pki/tls/certs/example_bundle.crt
    ServerName crm.example.com
</VirtualHost>
Make sure to have your server name properly configured as it should match the X.509 certificate's CommonName (or one of the SNA's, subject alternative names). More information regarding the certificate requests including the certificate chain can be obtained from your certification authority.
Ensure to redirect all non-secure HTTP (port 80) traffic to the secure virtual host.
<VirtualHost *:80>
    Redirect "/" "https://crm.example.com/"
</VirtualHost >
Cipher suite hardening
One of the crucial points of HTTPS is to force only secure cryptographic algorithms. Based on new future weaknesses which may be discovered in the future the recommended cipher suite settings can change. As per publish date of this document the usage of SSLv2 and SSLv3 is recommended to be disabled. The current safe secure transport protocols are TLSv1.0, TLSv1.1, and TLSv1.2 with properly configured cipher suites.
For proper deployment of Diffie-Hellman (DH) key exchange algorithms the following guidelines apply:
No longer use out-dated export cipher suites
Ensure the usage of Elliptic Curve Diffie-Hellman (ECDHE) based algorithms
Use of non-common Diffie-Hellman groupsÂ


Use of non-common Diffie-Hellman groupsÂ
More detail around the DH configuration and a detailed list of recommended cipher suites including web server configuration examples can be found at https://weakdh.org/sysadmin.html. Additionally, an online SSL/TLS checker can be used to generate a full report of your current configuration in case your web server is publically reachable. A recommended tool is https://www.ssllabs.com/ssltest/analyze.html. The output of this SSL/TLS test suite will guide you into further (optional) details which can be tweaked regarding your configuration (i.e. OCSP stapling, certificate pinning, â¦).
Please note that using the above instruction "perfect forward secrecy" will be enabled. This basically means that captured TLS traffic can only be decoded using the session key between a specific client and server. Nonperfect forwarding secrecy connections can always be decrypted by having access to only the server's private key. If the customer's setup has intermediate IDS/WAF systems to inspect traffic looking inside the secure traffic, having perfect forwarding secrecy configured may not be desirable.
Public trusted root CA's
It is recommended that the *nix system where Apache is running always has the latest public root CA (certification authority) files available to authenticate server certificates during the SSL/TLS handshake. Most *nix distributions take care of this through their online update process. If this is not the case, the system administrator is responsible to ensure the latest trusted root CA's are up-to-date. Out of the box, the SugarCRM application contacts the SugarCRM heartbeat and licensing server using a secure connection.
HSTS header


HSTS header
As all traffic requires HTTPS for SugarCRM, it is recommended to configure a global HSTS (HTTP Strict Transport Security) header. This is an additional opt-in security enhancement supported by most modern browsers. The HSTS will instruct the browser to always use HTTPS in the future for the given FQDN. More details regarding HSTS can be found here: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security.
Before enabling the HSTS header, ensure that no other non-HTTPS website is running for the given FQDN and any subdomains.
Header always set Strict-Transport-Security \
"max-age=10886400; includeSubdomains; preload"
Optionally when your SugarCRM application is publically reachable, you can submit your FQDN on the preload which is maintained by Chrome and included by Firefox, Safari, Internet Explorer 11 and Edge browser. Understand the consequences and requirements to end up on the preload list. Once registered, this cannot be undone easily. Submissions for the HSTS preload list can be found at https://hstspreload.appspot.com.
CSP header
A Content Security Policy header can be added to offer additional protection against XSS (cross-site scripting). Most modern browsers support CSP and will apply the limitation as directed by the CSP header. The CSP header defines the allowed sources through different directives which are allowed regarding JScript, CSS, images, fonts, form actions, plugins, â¦ More information can be found at https://www.owasp.org/index.php/Content_Security_Policy.
The management of CSP headers can become complex and may depend on different types of customizations which can be deployed on the SugarCRM platform.Â
For now, CSP headers can be configured directly on the web server. A basic configuration looks like this:Â
Header always set Content-Security-Policy \


Header always set Content-Security-Policy \
"default-src 'self'; script-src 'self'"
Note:Â This is a syntax example of a CSP header and not a recommended value.
Older browsers use the header X-Content-Security-Policy or X-WebKit-CSP instead of the standardized one. The CSP header can also safely be added first in "report only" mode before deploying it in production using Content-Security-Policy-Report-Only.
Additional security headers
To prevent clickjacking an X-Frame-Options header can be added. This header can also be used to iframe the SugarCRM application inside another web site if required. This can be better controlled with the above mentioned CSP header. Both can coexist together but it is encouraged to used the CSP approach.
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Frame-Options "ALLOW-FROM https://someothersite.com"
To protect against "drive-by download" attacks, it is encouraged to disable Content-Type sniffing. This is particularly targeted at Chrome and IE.
Header always set X-Content-Type-Options "nosniff"
Ensure XSS browser protection is enabled by adding the following header. By default, this feature should be enabled in every browser. In case it has been disabled, sending this header will re-enable it.
Header always set X-XSS-Protection "1; mode=block"
Secure cookie settings
Ensure the following settings are applied in php.ini to ensure legacy cookies are properly protected against XSS attacks and are only transmitted over a secure HTTPS connection.
session.cookie_httponly = 1
session.cookie_secure = 1
Additionally, the session.cookie_path can be tweaked if other applications are running on the same web server.
Security modules


Security modules
Additional Apache loadable security modules exist which can optionally be installed to better protect your system from malicious requests and/or DDOS attacks. The following modules are available for Apache 2.4:
mod_security - This module adds WAF (web application firewall) capabilities to your Apache setup. In combination with the OWASP CRS (core rule set) gives you a solid starting point for a WAF implementation.
mod_evasive - This module helps to prevent (D)DOS attacks
Covering both modules in details is out of the scope of this Security Response. Refer to the module documentation for additional details. In the future, SugarCRM may publish specific settings and fine-tuning for both modules.Â
Additional resources
Generic Apache security tipshttp://httpd.apache.org/docs/2.4/misc/security_tips.html
Online SSL/TLS testerhttps://www.ssllabs.com/ssltest/analyze.html
Useful HTTP headershttps://www.owasp.org/index.php/List_of_useful_HTTP_headers
Publication History
2015-10-01
Adding HTTP method restrictions
2015-09-08
Initial publication
A stand-alone copy of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. SugarCRM reserves the right to change or update this document at any time.
  	Last modified: 2023-02-03 21:04:03