Functional Matrix of Interceptors

Overview

Service Type Resources Operations Additional Permissions

WMS,
INSPIRE View Service
1.0 | 1.1 | 1.1.1 | 1.3
HTTP GET + POST

Layer

GetCapabilities
GetMap
GetFeatureInfo

  • Spatial

  • Copyright Remarks

  • Definition Queries
    (ArcGIS Server-based WMS only)

WMTS
1.0
HTTP KVP + REST

Layer

GetCapabilities
GetTile
GetFeatureInfo

  • Spatial

WFS,
INSPIRE Feature
Download Service
1.0 | 1.1 | 2.0
HTTP GET + POST

Feature Type

GetCapabilities
DescribeFeatureType
GetFeature
ListStoredQueries (2.0)
DescribeStoredQueries (2.0)
GetPropertyValue (2.0)

  • Spatial

  • OGC Filter Expressions

  • Stored Query Selection

WFS-T
1.0 | 1.1
HTTP GET + POST

Feature Type

See WFS, plus:
GetFeatureWithLock
LockFeature
Transaction

WCS
1.0 | 1.1 | 1.1.1
HTTP

Layer

GetCapabilities
DescribeCoverage
GetCoverage

Generic URL
HTTP GET + POST

URLs

GET, POST

ArcGIS Server
10.7.x | 10.8.x
REST + SOAP

Details about specific service types are listed in the following section.

ArcGIS Server Service Types

Service Type Resources Operations Additional Permissions

Catalog Server

Folder
Service

View

MapServer

Maps
Table
Layer

DisplayMap*
IdentifyFeatures*
QueryFeatures*

  • Spatial

  • Copyright Remarks

  • Definition Queries

  • Attributes Restriction

FeatureServer

Tables/Layers

GetMetadata*
Edit*
Query*

  • Definition Queries

  • Attribute value restrictions
    (on editing operations)

  • Attributes Restriction

GeoProcessingServer

Tools

Access

GeocodeServer
GeoDataServer
GeometryServer
GlobeServer
ImageServer
KmlServer
MobileServer
NAServer
SearchServer

Service

Access

* Operation assembles multiple SOAP & REST operations

Limitations

WFS

  • Spatial Restrictions Spatial restrictions are not supported with ArcGIS Server WFS due to the lack of support for filters with Multisurface geometries in ArcGIS.

  • OGC Filter Expressions

    • HTTP GET requests with BBOX parameter or FILTER parameter are not supported for ArcGIS Server WFS implementations

    • HTTP GET requests with BBOX parameter are not supported for XtraServer WFS 1.0.0 implementations

  • WFS 2.0

    • OGC Filter Expression obligations are only supported with integrated XtraServer-Security

    • Geoserver WFS

      • Strict CITE Compliance has to be set in Geoserver

      • HTTP GET GetFeature requests are not supported

      • HTTP GET GetPropertyValue are not supported

      • HTTP GET DescribeFeatureType requests are not supported

    • GetPropertyValue requests using the GetFeatureById Stored Query are not supported

    • Stored query support:

      • DropStoredQuery and CreateStoredQuery are not supported

      • Private stored queries are not supported and are filtered from the ListStoredQuery and DescribeStoredQuery responses. The only exception to this is the GetFeatureById predefined stored query.

      • All public stored queries are set as 'private'. The body of the queries is filtered from the DescribeStoredQuery response.

      • Only stored queries which return feature types matching the feature types listed in the GetCapabilities response are supported.

        For example stored queries using gml:AbstractFeature or the schema-element expression are not supported (such as GetDatasetByCrs). They are filtered from the ListStoredQuery and DescribeStoredQuery responses.

      • Only stored queries with a body using the query language urn:ogc:def:queryLanguage:OGC-WFS::WFS_QueryExpression are supported.

INSPIRE Feature Download Service

  • Spatial Obligations: Not supported for INSPIRE Feature Download Services based on ArcGIS for INSPIRE

ArcGIS Server

  • Binary protocol: The binary message format supported by ArcGIS Server cannot be used to access services protected by security.manager.

  • Attributes Restriction:

    • When using attributes restrictions, the asterisk-operator ( * ) as in SELECT * FROM table_name is not allowed on operations with SQL queries as parameters. Examples are where or layer definitions

    • Further hint on the usage of attribute restrictions can be found in the user guide at Creating Rights for ArcGIS Server

  • OGC WCS 2.0.1: The OGC WCS specification 2.0.1 is not supported.

MapServer

  • Requests containing Dynamic Layers

    • SOAP operations are blocked by security.manager.

    • Layer-based permissions (incl. obligations) are only enforced for dynamic map layers. Access to dynamic data layers is always denied without restriction.

  • Attributes Restrictions

    • These SOAP request are blocked:
      Find, GenerateDataClasses, QueryHTMLPopups, QueryHTMLPopups2, QueryRelatedRecords, QueryRelatedRecords2, QueryDataStatistics, QueryRowIDs, QueryRowCount, QueryHyperlinks, QueryFeatureIDs, QueryFeatureIDs2, QueryFeatureCount, QueryFeatureCount2, ExportScaleBar, GetLegendInfo2, FromMapPoints, ToMapPoints, ComputeScale, QueryRowCount, QueryRowIDs, QueryData, QueryRasterValue2, QueryAttachmentInfos2, QueryAttachmentData2, QueryFeatureData, QueryFeatureData2, GetMapTableSubtypeInfos, GetMapTableSubtypeInfos2

    • HTML Popup requests are blocked

  • Spatial Restrictions

    • Spatial restrictions do not work, if a layer that contains curve geometries is queried with the option returnTrueCurves = true

    • queryRelatedRecords requests are blocked, if spatial restrictions are define

    • When using the historicMoment parameter, spatial restrictions affect the geometry of a feature that it has at the time of the historicMoment. Features that are filtered out by a spatial restriction can be successfully queried using the historicMoment parameter, if their current geometry differs from the one at the historicMoment.

  • Definition Queries: When using the historicMoment parameter, definition query restrictions affect the attribute values of a feature that it has at the time of the historicMoment. Features that are filtered out by a valid definition query restriction can possibly be queried successfully using the historicMoment parameter, if their current geometry differs from the one at the historicMoment.

  • Query Layer: Query layers published via ArcGIS Pro are not supported. Do not protect and access them with security.manager. This includes the following parameters in export, identify, find and query operations:

    • mapRangeValues

    • layerRangeValues

    • layerParameterValues

    • rangeValues

    • parameterValuesQuery

  • Legends and renderers: Definition queries and attribute restrictions don’t affect legends or render definitions when returned by protected services. This might allow to deduce the existence or values of forbidden attributes. Additionally forbidden objects could be revealed in legends, for example.

FeatureServer

  • SOAP operations are not supported.

  • Operations to work with replicas are not supported.

  • The extractChanges operation is always blocked, even if the ArcGIS FeatureServer offers it.

  • Adding, updating and deleting feature attachments with ArcMap is not possible, because ArcMap requires replica capabilities.

  • Definition Queries: When using the historicMoment parameter, definition query restrictions affect the attribute values of a feature that it has at the time of the historicMoment. Features that are filtered out by a valid definition query restriction can possibly be queried successfully using the historicMoment parameter.

  • The applyEdits operation with "splits" does only support spatial obligations using the "within" spatial operation. Service requests are blocked, when spatial operation type "intersect" is selected.

  • Validation layers (validationSystemLayers) are not supported.

  • Topology layers published together with Feature Layers are not supported.

  • The operations queryDataElements and queryContingentValues are not supported.

  • Hosted Feature Servers are not supported.

  • Utility Network Layers

    • The "Utility Network" tab in ArcGIS Pro is not available for protected feature services.

    • Denying access to individual sub-layers or tables of a Utility Network Layer is not supported.