From DDM 1.5 onwards, Dante Domain Manager exposes a GraphQL API endpoint (the Dante Managed API) on the server at /graphql.
Can the API be disabled?
Yes. If your security policy requires it, you can disable the API endpoint from the Appliance Menu. When disabled, requests to the endpoint return 502 – Bad Gateway. You can re-enable it from the same menu at any time.
We recommend leaving the API enabled, as it is used by DDM product features and third-party integrations.
How is API access controlled?
- Every request must be authenticated with an API key or user token. Requests without one are rejected.
- The API has the same permissions as the user whose key or token is used, so it can’t do more than that user can in the DDM web interface.
- API key management is off by default. A Site Admin can turn it on under Settings in the DDM web interface.
- Once it’s on, each user can create API keys with the same permissions as their own account.
Are API calls encrypted?
If a TLS certificate is installed on the DDM server to enable HTTPS for the web interface, all API traffic is also encrypted over HTTPS. We strongly recommend installing a TLS certificate on every DDM server