# Feature Configuration REST API

This API allows users with the [System Administrator role](https://help.sonatype.com/en/role-management.html "Role Management"), or the [Edit System Configuration and Users permission](https://help.sonatype.com/en/role-management.html "Role Management") to enable/disable certain Nexus IQ Server features.

## Features supported:

The table below shows the features that can be enabled/disabled via this REST API. The "Supported From" column indicates the Sonatype IQ server release that supports the enabling/disabling of each feature using this REST API.

| Feature | Default Value | Description | Supported From |
| --- | --- | --- | --- |
| OAUTH2\_ENABLED | Disabled | When enabled, the _System Preferences - OAuth2 Configuration_ option is available for configuring OIDC. |  |
| sbomBinaryScanning | Enabled | When enabled, allow for scanning of binary files when importing SBOM |  |
| skipSbomImportValidation | Disabled | When enabled, schema validations for CycloneDX are skipped before ingestion. The identity information is parsed. |  |
| internalFirewallOnboardingEnabled | Enabled | When disabled, the Repository Firewall Guided Setup is no longer displayed. |  |
| scan-npm-dev-and-opt-dependencies | Disabled | When enabled, optional and devDependencies are included in scans for manifest and lock files.<br>Note that analysis only looks at `devDependencies` and `optionalDependencies` defined in the `package.json` file for the direct dependencies. Transitive dependencies brought in from the `package-lock.json` will not be included in the analysis. |  |
| scan-pom-files-in-meta-inf-directory | Disabled | When enabled, pom.xml files within META-INF directories are included in scans. |  |
| developerSuggestNonBreakingVersion | Disabled | Enable this feature for [Golden Versions and Golden PR](https://help.sonatype.com/en/golden-versions-and-prs.html "Golden Versions") recommendations. |  |
| autowaivers | Disabled | Enable this feature for [Automated Waivers](https://help.sonatype.com/en/automated-waivers.html "Automated Waivers") |  |
| defaultBranchMonitoring | Enabled | Controls the default [branch monitoring feature](https://help.sonatype.com/en/continuous-risk-profile.html "Continuous Risk Profile") that is part of the continuous risk profile that the Sonatype for SCM integration generates. | Release 120 |

## POST to Enable a Feature

To enable a feature, you can make a POST request to the following path:

### For release 154 and later:

```
POST /api/v2/config/features/{feature}
```

### Example:

```
curl -u admin:admin123 -X POST 'http://localhost:8070/api/v2/config/features/scan-pom-files-in-meta-inf-directory'
```

### For release 153 and earlier:

```
POST /api/experimental/config/features/{feature}
```

### Example:

```
curl -u admin:admin123 -X POST 'http://localhost:8070/api/experimental/config/features/scan-pom-files-in-meta-inf-directory'
```

The feature must match (case-sensitive) one of those from the table.

## Response:

A successful request yields HTTP status code 204.

If an invalid feature is supplied, or the feature is already enabled, then the request yields a bad request response with HTTP status code 400.

## DELETE to Disable a Feature

To disable a feature, you can make a DELETE request to the following path:

### For release 154 and later:

```
DELETE /api/v2/config/features/{feature}
```

### Example:

```
curl -u admin:admin123 -X DELETE 'http://localhost:8070/api/v2/config/features/scan-pom-files-in-meta-inf-directory'
```

### For release 153 and earlier:

```
DELETE /api/experimental/config/features/{feature}
```

### Example:

```
curl -u admin:admin123 -X DELETE 'http://localhost:8070/api/experimental/config/features/scan-pom-files-in-meta-inf-directory'
```

The feature must match (case-sensitive) one of those from the table.

## Response:

A successful request yields HTTP status code 204.

If an invalid feature is supplied, or the feature is already disabled, then the request yields a bad request response with HTTP status code 400.