Some of OCLC's APIs do support JSONP or CORS: for example
QuestionPoint API, the xIdentifier and MapFAST services. However,
other services do not provide this support. This is because for these
services we need to carefully ensure that the application making the
request is actually owned by the institution/user to which the key has
been issued. If we don't do this then there are several consequences

1. We aren't able to clearly distinguish who is using a given service.
This fundamentally makes it more difficult for us to keep statistics
and evaluate the value of our services to the OCLC membership.
2. Users/Institutions not eligible to use particular services are able
to access those services.
3. Other users/institutions may be able to see data which is private
and specific to a particular institution

We know that developers want to use our APIs in Javascripts. As a
result we're working really hard on potential solutions that would
allow us to both provide this type of access and ensure that the
application making the request of the API is coming from an
appropriate authorized institution/user.

If anyone has further questions, they are welcome to email me directly.

Karen

Karen Coombs
Product Manager
OCLC Developer Network
[log in to unmask]


On Mon, Oct 3, 2011 at 8:21 AM, Ed Summers <[log in to unmask]> wrote:
> On Wed, Sep 28, 2011 at 5:36 PM, Godmar Back <[log in to unmask]> wrote:
>> Closer to the code4lib community: OCLC and Serials Solutions don't support
>> JSONP in their webservices, either, even though doing so would allow cool
>> services and would likely not affect their business models adversely in a
>> significant way, IMO. We should keep lobbying them to remove these
>> restrictions, as I've been doing for a while.
>
> I agree. I'm not sure how pervasive it is at OCLC, but their MapFast
> Service supports Cross Origin Resource Sharing (CORS) [1,2], which
> means that JSONP isn't needed for modern browsers. Basically it's just
> adding the following header to the JSON response:
>
>    Access-Control-Allow-Origin: *
>
> Something to think about when creating a web service for others, at any rate.
>
> [1] http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing
> [2] http://inkdroid.org/journal/2011/02/09/oclcs-mapfast-and-cors/
>