- 10 minutes to read

Prerequisites for the Nodinite Web API

Prepare your environment for a seamless Nodinite Web API deployment. This guide details all technical prerequisites, security requirements, and best practices to ensure a successful installation and smooth operation.

✅ Complete checklist for Windows, SQL, and firewall requirements
✅ Visual architecture diagrams for clarity
✅ Direct links to troubleshooting and expert support

This page describes the prerequisites to install and run the Nodinite Web API successfully.

The Nodinite Web API is an IIS web site, with its own port, and part of the Core Services package. You configure it in the Nodinite Portal and install it with the generated CLI package; see Install Nodinite v7 and the general Prerequisites for Installing Nodinite.

graph LR subgraph "Reporting tools and scripts" roReport[fal:fa-chart-line-up Metrics chart Custom Reports] end subgraph "Application Server" roLoggingService(fal:fa-hard-drive Logging Service) --- roWebAPI roMonitoringService --- roWebAPI roWebClient(fal:fa-globe Web Client) ---roWebAPI(fal:fa-cloud-sun Web API) end subgraph "SQL Server" roConfigDatabase(fal:fa-database Configuration database) --- roLogDatabase(fal:fa-database fal:fa-database fal:fa-database Log databases) roWebAPI --- roConfigDatabase roLoggingService -.- roConfigDatabase roMonitoringService(fal:fa-watch-fitness Monitoring Service) -.- roConfigDatabase roReport --- roWebAPI end

The diagram above illustrates the architecture and key dependencies for the Nodinite Web API.

Verified Topic
IIS Windows Features
MSDTC
Windows rights
Database rights
Firewall

Use the checklist above to verify that you have performed all steps required to get Nodinite flying.

IIS Windows Features

The Nodinite Web API is an IIS-hosted web site built on .NET 10 and ASP.NET Core. The server needs Windows Server 2019 or later and the .NET 10 Hosting Bundle; see Prerequisites for Installing Nodinite.

Key requirements

  • Windows Authentication - Required when the environment uses Windows Authentication (the auth mode is set in the Portal, Auth step)
  • ASP.NET Core Module V2 - Required for .NET 10; install the IIS features before the .NET 10 Hosting Bundle

IIS Windows Features - Complete feature list, installation scripts, and troubleshooting

Microsoft Distributed Transaction Coordinator (DTC)

The Web API is involved in SQL Server related operations. Nodinite uses the Windows Service Microsoft Distributed Transaction Coordinator (DTC),responsible for coordinating transactions that span multiple resource managers. We have written a dedicated tutorial for Nodinite with the best practices to install and configure the DTC Windows Service.

Important

You must configure the DTC as documented. Otherwise, Nodinite will not be operational.

What Windows rights does the Web API require?

The Nodinite Web API runs as an IIS web site with a dedicated App Pool. Its service identity is set in the Nodinite Portal: the defaults in the Auth step, Service Account Defaults (a gMSA is supported, see gMSA accounts), or a separate account per service in the Servers step, Core platform services. The generated CLI package creates the App Pool with that identity.

Service Account Requirements

  • The App Pool service account must be able to login to the server: Allow Logon locally
  • If the service account is not a local administrator, it must be a member of the IIS_IUSRS group
  • The service account must have Read rights on %windows%\system32\inetsrv\config folder (for redirection.config access)

Note

To grant a user account the ability to log on locally to a domain controller, you must make that user a member of a group that already has the "Allow logon locally" system right, or grant the right to that user account directly.

How It Works

The generated CLI package creates a dedicated IIS App Pool for the Web API:

  • The App Pool runs with the service identity set in the Portal
  • Calls to SQL Server are performed as this identity, so this is the account that needs the SQL rights below
  • Each caller is still authenticated individually (Windows Authentication or OAuth 2.0), and Nodinite Roles decide what the caller can see and do; Log Audits record the caller's identity

IIS Authentication settings - Complete guide to authentication configuration, encryption, and troubleshooting
IIS_IUSRS Group Membership - How to configure service accounts for least-privilege deployments

Important

If the Windows User account for the Application Pool is not assigned the sysadmin role, add the account to the LogServiceUsers System Parameter. When the Logging Service creates a new Log Database, it grants the database roles in LogAccessRoles to every account in that list.

For the complete rights matrix and non-sysadmin operating model, see SQL Server Sysadmin Requirements.

Tip

Troubleshooting permissions: If you encounter "Cannot read configuration file due to insufficient permissions" errors, ensure the App Pool account has Read rights on %windows%\system32\inetsrv\config. See the IISConfigurationFile troubleshooting guide.

What SQL Rights does the Web API require?

Master

Grant VIEW SERVER STATE rights.

GRANT VIEW SERVER STATE TO [Domain\user]

Replace [Domain\user] with the Windows account being used for the Web API (its service identity).

If applicable, repeat the grant on all nodes part of an AOAG environment.

AOAG

Apply the settings below if you are using SQL Server Always on.

Grant GRANT VIEW DEFINITION ON AVAILABILITY GROUP rights.

GRANT VIEW DEFINITION ON AVAILABILITY GROUP ::AOAGGROUPNAME TO [Domain\user];

Replace [Domain\user] with the Windows account being used for the Web API (its service identity).

If applicable, repeat the grant on all nodes part of an AOAG environment.

Nodinite databases

The Nodinite Web API accesses the Configuration Database and the Log Databases with its service identity (set in the Portal) and requires the following SQL roles and grants:

Database Permission Description Microsoft Docs Link
Configuration Database db_datareader Grants read access to all tables and views db_datareader
Configuration Database db_datawriter Grants write access to all tables and views db_datawriter
Configuration Database db_ddladmin Allows running DDL statements (e.g., create/alter/drop objects) db_ddladmin
Configuration Database sysadmin/db_owner Required for certain administrative tasks (e.g., shrinking databases) sysadmin, db_owner
Log Databases db_datareader Grants read access to all tables and views db_datareader
Log Databases db_datawriter Grants write access to all tables and views db_datawriter
Log Databases db_ddladmin Allows running DDL statements (e.g., create/alter/drop objects) db_ddladmin

This table lists the minimum SQL Server permissions required for the Nodinite Web API's Configuration Database and Log Databases. Ensure these grants are set for uninterrupted operation, maintenance, and automation.

Grant Execute rights on all existing and future stored procedures for the account used by the Web API:

GRANT EXECUTE TO [Domain\user]

Replace [Domain\user] with the Windows account being used for the Web API.

Important

db_ddladmin is required for the service account to have proper rights to read statistics. Without this permission, performance may be degraded, especially true for remote servers (linked servers). Read more top 3 performance killers for linked server queries. Contact our support if you have any questions about this.

Tip

Review the System Parameters LogServiceUsers and LogAccessRoles so that the Web API account gets these roles on every new Log Database. The System Parameters that the Web API itself reads, such as SqlServer and ProductArtifactsPath, are listed in System Parameters in Manage the Web API.

What Firewall settings are required for the Web API

The Web API is the hub of the Nodinite Core Services: the Web Client, reporting tools, and scripts call it; it calls the Logging Service and the Monitoring Service; and it is the Core Service that reads and writes most data in SQL Server. In OAuth 2.0 mode, callers get tokens from Microsoft Entra ID and the Web API validates them. The diagram shows each host, with the port on the arrow, drawn from the side that opens the connection.

graph LR subgraph "Reporting tools and scripts" roReport["fa:fa-chart-line-up Excel, custom reports, automation scripts"] end subgraph "Nodinite Core Services Server" roWebClient["fa:fa-globe Web Client - IIS"] roWebAPI["fa:fa-cloud-sun Web API - IIS"] roLS["fa:fa-hard-drive Logging Service - IIS"] roMS["fa:fa-watch-fitness Monitoring Service - IIS"] end subgraph "SQL Server" roConfig["fa:fa-database Configuration Database"] roLogDB["fa:fa-database Log Databases"] end subgraph "Domain Controller" roDC["fa:fa-server DNS, Kerberos, LDAP"] end subgraph "Microsoft Entra ID - OAuth mode only" roEntra["fab:fa-microsoft login.microsoftonline.com"] end roReport -->|"HTTPS, Web API port"| roWebAPI roWebClient -->|"Web API port"| roWebAPI roWebAPI -->|"Logging Service port"| roLS roWebAPI -->|"Monitoring Service port"| roMS roWebAPI -->|"TCP 1433, MSDTC 135 + RPC"| roConfig roConfig -->|"Linked Server"| roLogDB roWebAPI -->|"53, 88, 389"| roDC roReport -.->|"HTTPS 443, get token"| roEntra roWebAPI -.->|"HTTPS 443, signing keys"| roEntra

Diagram: reporting tools, scripts, and the Web Client call the Web API on its Portal port; the Web API calls the Logging Service, the Monitoring Service, SQL Server, and the domain controller. Dotted arrows apply only in OAuth 2.0 mode.

Note

Ports are set per environment: on Windows Server, each Core Service is its own IIS web site with its own port. You set the ports in the Nodinite Portal, in the Servers step, Core platform services, and review them in Allocated ports. Ports in examples, such as 40001 in https://nodinite.contoso.com:40001, are examples only. The generated CLI package creates the IIS bindings, not the firewall rules.

Between the callers and the Web API

The users' browsers never call the Web API directly; they call the Web Client, which calls the Web API on the same server. See the Web Client prerequisites for the browser hop.

Direction Source Destination Protocol Port(s) Purpose Notes
Inbound Reporting tools and scripts Core Services Server (Web API) TCP (HTTPS) Web API port REST calls for reports, metrics, and automation Set in the Portal; open only to the networks that run reports or scripts
Inbound Core Services Server (Web Client) Core Services Server (Web API) TCP (HTTPS) Web API port Every Web Client page Same server; no rule needed unless a host firewall restricts local traffic
Outbound Reporting tools and scripts Microsoft Entra ID (login.microsoftonline.com) TCP (HTTPS) 443 Get a bearer token for the Web API audience OAuth 2.0 mode only; see Manage the Web API

Between the Web API and the other Core Services

The Web API finds the Logging Service and the Monitoring Service through the ProductArtifactsPath System Parameter, which the installer sets. All Core Services run on the one server selected in the Portal (Servers step), so open these ports only if a host firewall restricts local traffic.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Web API) Core Services Server (Logging Service) TCP (HTTPS) Logging Service port Logging Service status and operations Set in the Portal
Outbound Core Services Server (Web API) Core Services Server (Monitoring Service) TCP (HTTPS) Monitoring Service port Monitoring Service status and operations Set in the Portal
Inbound Core Services Server (Logging Service, Monitoring Service) Core Services Server (Web API) TCP (HTTPS) Web API port The services call the Web API for their features Set in the Portal

Between the Web API and SQL Server

The SQL Server, MSDTC, and domain controller ports are shared by all Nodinite components; their full details live in SQL Server Firewall Configuration.

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Web API) SQL Server (Configuration Database) TCP 1433 Read and write configuration and log data Default instance port; the Log Databases are reached through the Configuration Database's Linked Servers. Named instances and changed ports: Core Services to SQL Server
Outbound Core Services Server (Web API) SQL Server UDP 1434 SQL Server Browser Only for a named instance without a port in the connection string; see SQL Server Browser Service
Both Core Services Server (Web API) SQL Server TCP 135 + dynamic RPC range MSDTC distributed transactions Configure MSDTC on both servers; see Core Services to SQL Server

Between the Web API and the domain controller and Microsoft Entra ID

Direction Source Destination Protocol Port(s) Purpose Notes
Outbound Core Services Server (Web API) Domain Controller (DNS server) TCP/UDP 53 DNS name resolution Hosts-file entries are a fallback
Outbound Core Services Server (Web API) Domain Controller TCP/UDP 88, 389 Kerberos for Windows Authentication of callers and SQL Server; LDAP group lookups for Roles See Domain Controller ports
Outbound Core Services Server (Web API) Microsoft Entra ID (login.microsoftonline.com) TCP (HTTPS) 443 Read the OpenID configuration and token signing keys OAuth 2.0 mode only; through the proxy set in Step 3: Infrastructure if you use one

What to get right

  • No fixed default port: the Web API port is whatever you set in the Portal; scripts and reports must use the full base URL, including the port.
  • Versions: Nodinite v7 replaced the fixed ports of earlier versions with Portal ports; see Why do Nodinite use port 8000 when you clean up old rules.
  • DNS (53): callers must resolve the Web API host name that matches its TLS certificate, and Windows Authentication needs that name, not an IP address, for Kerberos.

Frequently asked questions

Additional solutions to common problems and the Nodinite Web API FAQ exist in the Troubleshooting user guide. For anything else, see the Support page.

Can I secure the Web API?

Yes. The Web API uses TLS (HTTPS). You enter the host name (FQDN) and the certificate subject in the Portal, in the Servers step, Core host Configuration, and the CLI package binds the certificate to the Web API site. In OAuth 2.0 mode, the Web API also requires a bearer token issued for the Web API audience set in the Auth step, Web API; see Manage the Web API.

Important

Review the Nodinite IIS Hardening user guide and TLS Troubleshooting for more information.

Note

Nodinite v6 is no longer supported. To move an existing v6 installation, follow Updating from v6 to v7.

Next Steps

Install Web API
IIS Windows Features
MSDTC
Manage the Web API

Core Services Package
Web API
Configuration Database
Hardening
IIS Authentication settings
Log Audits
Log Databases
Logging Service
Monitoring Service
Roles
System Parameters
SQL Server Firewall
Troubleshooting
Uninstall Web API
Update Web API