Missing documentation about explicit warning for user cannot run REST API to add/remove systemModel aspect to node

Description

All our doc stated in:
https://api-explorer.alfresco.com/api-explorer/#/nodes/updateNode

“Note: if you want to add or remove aspects, then you must use GET /nodes/{nodeId} first to get the complete set of aspectNames.”

However, the fact is that we explicitly do not allow a user to add/remove systemModel level aspect/properties via REST v1 API. It should also be mentioned as explicit not and documented in API explorer specifically to avoid customer confusion.

Steps to reproduce
Run a REST API v1 call to update a node to add sys:hidden aspect to one of my existing node (ACS 6.2.2)

1. Run a GET call first as the documentation stated to get a full list of aspectNames

e.g.
GET http://sup-sliaw-win2016.eastus.cloudapp.azure.com:8180/alfresco/api/-default-/public/alfresco/versions/1/nodes/9d092811-1955-469d-b2ca-9ae24cd975ce?include=aspectNames,properties

response looks like:

2. Next, run the PUT request to add sys:hidden aspect to the node.

Request:
PUT http://sup-sliaw-win2016.eastus.cloudapp.azure.com:8180/alfresco/api/default/public/alfresco/versions/1/nodes/9d092811-1955-469d-b2ca-9ae24cd975ce

Request body:
{
“aspectNames”: [
“rn:renditioned”,
“cm:versionable”,
“cm:titled”,
“cm:auditable”,
“cm:author”,
“cm:thumbnailModification”,
“sys:hidden”
]
}

3. Execute the PUT request

Actual:
Error return:

The investigation has shown one can’t add sys models like sys:hidden or sys:temporary with the REST API.

https://github.com/Alfresco/alfresco-community-repo/blob/master/remote-api/src/main/java/org/alfresco/rest/api/impl/NodesImpl.java#L337

Workaround:

Create a custom aspect with sys:hidden as a mandatory aspect as part of the model definition.
Use other APIs (such as Javascript API) which provide access. It’s just the REST API that doesn’t, AFAIK.

Environment

None

Assignee

Kaz Kono

Reporter

Seng Ei Liaw

ACT Numbers

00383095

Bug Priority

Category 4