1 Why did Krishagni develop a REDCap plugin instead of using REDCap’s APIs?
2 Does the plugin modify the REDCap database schema or data?
3 Is the plugin forward-compatible with REDCap upgrades?
4 Are the APIs exposed by the plugin aligned with REDCap’s existing API security model?
5 Does the plugin introduce any new API endpoints?
6 How are access controls and auditing enforced?

Why did Krishagni develop a REDCap plugin instead of using REDCap’s APIs?

The standard REDCap APIs lack the endpoints we need. OpenSpecimen needs data and metadata for instruments, as well as delta changes since the last sync run.

To avoid this, Krishagni has developed a REDCap plugin which exposes additional APIs using the REDCap audit logs and internal APIs.

Does the plugin modify the REDCap database schema or data?

No, the plugin is read-only. It does not modify the REDCap schema or data. It uses queries to expose the APIs required for incremental synchronisation.

Is the plugin forward-compatible with REDCap upgrades?

No software can commit to forward compatibility when it comes to integrating with a third party.

The plugin depends on a few standard fields in REDCap's core tables (e.g, redcap_events_metadata, redcap_projects, and redcap_data), which have been mostly static.

We will provide an updated plugin when a REDCap version with breaking changes is released. E.g. REDCap v14.

Are the APIs exposed by the plugin aligned with REDCap’s existing API security model?

Yes, the plugin ensures the following:

The API token is issued per project.
User has read access to the project's audit logs (data_logging = 1).

Does the plugin introduce any new API endpoints?

The plugin introduces a new endpoint /plugins/openspecimen_plugin.php to allow OpenSpecimen download:

Project events with their DB IDs
Instrument details
List of records that got modified since the last sync

How are access controls and auditing enforced?

Invoking this API requires users to have read and write data and logging rights on the project. Since the plugin runs in the REDCap context, the REDCap logging module tracks the plugin APIs invoked by the client/user.