API Integration

The portals talk to one service for all data operations: the UI Backend REST API, reached at /iot-webservice/ through the container’s own Nginx proxy.

Backend base URL

ApiService (@ft/common/services) builds every request from the runtime configuration:

const url = AppConfigService.settings.server.api + 'iotw/' + path;

server.api is patched to the relative path /iot-webservice/ at container start, so the deployed requests look like /iot-webservice/iotw/<path> on the portals origin, and Nginx proxies them to FT_UI_BACKEND_URL. When running from source, server.api holds an absolute development URL and the browser calls the backend directly. See Configuration.

HTTP client setup

Piece Behaviour

Piece	Behaviour
`ApiService`	`get` / `post` / `put` / `patch` / `delete` helpers with `Content-Type: application/json` and a configurable `responseType`.
`TokenInterceptor`	Adds `Authorization: Bearer <token>` read from `sessionStorage`. Requests to the whitelist (`/assets`, `/app-config.json`, `/i18n/en.json`, `/Auth/`, `/User/password/restore`, selected `/Setting/interface/` and `/System/information`) pass without a token; other requests are aborted client-side when no token is present. External endpoints such as the geolocation API bypass the interceptor entirely.
`ErrorHandlerInterceptor`	Catches HTTP failures, dispatches an error notification into the store, and handles authentication errors centrally (including the aborted-request code `0000`).

ApiService

get / post / put / patch / delete helpers with Content-Type: application/json and a configurable responseType.

TokenInterceptor

Adds Authorization: Bearer <token> read from sessionStorage. Requests to the whitelist (/assets, /app-config.json, /i18n/en.json, /Auth/, /User/password/restore, selected /Setting/interface/ and /System/information) pass without a token; other requests are aborted client-side when no token is present. External endpoints such as the geolocation API bypass the interceptor entirely.

ErrorHandlerInterceptor

Catches HTTP failures, dispatches an error notification into the store, and handles authentication errors centrally (including the aborted-request code 0000).

Request flow

Feature code dispatches NgRx actions; effects call the backend through ApiService and feed results back into the store (see State & Data Flow).
All data operations — authentication, session, platform APIs — go through this single base URL.
Uploads (firmware, configuration files) use the same origin; the proxy allows request bodies up to 1000 MB and 300-second timeouts.

Other proxied upstreams

Path Used by

Path	Used by
`/ai-agent/`	`AIService` (`@ft/common/ai`). Its base URL comes from the backend setting `AIServiceConnectionURL`; the assistant is hidden when that setting is empty or the user group lacks the AI permission.
`/grafana-ro/`	The embedded Grafana dashboards on the Management Portal system-overview pages. The dashboard URLs come from backend settings, and the frames are marked trusted with Angular’s `DomSanitizer`.

/ai-agent/

AIService (@ft/common/ai). Its base URL comes from the backend setting AIServiceConnectionURL; the assistant is hidden when that setting is empty or the user group lacks the AI permission.

/grafana-ro/

The embedded Grafana dashboards on the Management Portal system-overview pages. The dashboard URLs come from backend settings, and the frames are marked trusted with Angular’s DomSanitizer.

Portal permissions

On startup the portals container uploads a permissions configuration per portal to the backend (sc / mc). This governs what user groups can do and is applied server-side. See Installation & Deployment.