Rest Cheat Sheet

1. Rest Assured Cheat Sheet Pdf
2. Jigglypuff Rest Cheat Sheet

• Probably the Best Regular Expression Cheat Sheet on the Net. The most commonly used metacharacters in Python, PHP, Perl, JavaScript, and Ruby. Rest of the line is.
• Stateful services are out of scope of this Cheat Sheet: Passing state from client to backend, while making the service technically stateless, is an anti-pattern that should also be avoided as it is prone to replay and impersonation attacks. In order to implement flows with REST APIs, resources are typically created, read, updated and deleted.

In this article we will provide Brief definition of REST (Representational State Transfer) with couple of cheat sheet from web. Brief definition of REST (Representational State Transfer): Representational state transfer (REST) is a software architectural style that defines a set of constraints to be used for creating Web services. Web services that conform to the Continue reading 'REST.

Last revision (mm/dd/yy): 09/4/2018

• 8Validate content types
• 12Security headers

REST (or REpresentational State Transfer) is an architectural style first described in Roy Fielding's Ph.D. dissertation on Architectural Styles and the Design of Network-based Software Architectures. It evolved as Fielding wrote the HTTP/1.1 and URI specs and has been proven to be well-suited for developing distributed hypermedia applications. While REST is more widely applicable, it is most commonly used within the context of communicating with services via HTTP.

The key abstraction of information in REST is a resource. A REST API resource is identified by a URI, usually a HTTP URL. REST components use connectors to perform actions on a resource by using a representation to capture the current or intended state of the resource and transferring that representation. The primary connector types are client and server, secondary connectors include cache, resolver and tunnel. In order to implement flows with REST APIs, resources are typically created, read, updated and deleted. For example, an ecommerce site may offer methods to create an empty shopping cart, to add items to the cart and to check out the cart.

Another key feature of REST applications is the use of standard HTTP verbs and error codes in the pursuit or removing unnecessary variation among different services.

Another key feature of REST applications is the use of HATEOS or Hypermedia as the Engine of Application State. This provides REST applications a self-documenting nature making it easier for developers to interact with a REST service without a priori knowledge.

Secure REST services must only provide HTTPS endpoints. This protects authentication credentials in transit, for example passwords, API keys or JSON Web Tokens. It also allows clients to authenticate the service and guarantees integrity of the transmitted data.

See the Transport Layer Protection Cheat Sheet for additional information.

Consider the use of mutually authenticated client-side certificates to provide additional protection for highly privileged web services.

Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic and session management. This has several drawbacks for modern architectures which compose multiple micro services following the RESTful style.

• in order to minimise latency and reduce coupling between services, the access control decision should be taken locally by REST endpoints
• user authentication should be centralised in a Identity Provider (IdP), which issues access tokens

There seems to be a convergence towards using JSON Web Tokens (JWT) as the format for security tokens. JWTs are JSON data structures containing a set of claims that can be used for access control decisions. A cryptographic signature or message authentication code (MAC) can be used to protect the integrity of the JWT.

Rest Assured Cheat Sheet Pdf

• Ensure JWTs are integrity protected by either a signature or a MAC. Do not allow the unsecured JWTs: {'alg':'none'}. See https://tools.ietf.org/html/rfc7519#section-6.1
• In general, signatures should be preferred over MACs for integrity protection of JWTs.

If MACs are used for integrity protection, every service that is able to validate JWTs can also create new JWTs using the same key. This means that all services using the same key have to mutually trust each other. Another consequence of this is that a compromise of any service also compromises all other services sharing the same key. See https://tools.ietf.org/html/rfc7515#section-10.5 for additional information.

The relying party or token consumer validates a JWT by verifying its integrity and claims contained.

• A relying party must verify the integrity of the JWT based on its own configuration or hard-coded logic. It must not rely on the information of the JWT header to select the verification algorithm. See https://www.chosenplaintext.ca/2015/03/31/jwt-algorithm-confusion.html and https://www.youtube.com/watch?v=bW5pS4e_MX8

Some claims have been standardised and should be present in JWT used for access controls. At least the following of the standard claims should be verified:

• 'iss' or issuer - is this a trusted issuer? Is it the expected owner of the signing key?
• 'aud' or audience - is the relying party in the target audience for this JWT?
• 'exp' or expiration time - is the current time before the end of the validity period of this token?
• 'nbf' or not before time - is the current time after the start of the validity period of this token?

Jigglypuff Rest Cheat Sheet

Public REST services without access control run the risk of being farmed leading to excessive bills for bandwidth or compute cycles. API keys can be used to mitigate this risk. They are also often used by organisation to monetize APIs; instead of blocking high-frequency calls, clients are given access in accordance to a purchased access plan.

API keys can reduce the impact of denial-of-service attacks. However, when they are issued to third-party clients, they are relatively easy to compromise.

• Require API keys for every request to the protected endpoint.
• Return 429 'Too Many Requests' HTTP response code if requests are coming in too quickly.
• Revoke the API key if the client violates the usage agreement.
• Do not rely exclusively on API keys to protect sensitive, critical or high-value resources.

• Apply a whitelist of permitted HTTP Methods e.g. GET, POST, PUT

• Reject all requests not matching the whitelist with HTTP response code 405 Method not allowed
• Make sure the caller is authorised to use the incoming HTTP method on the resource collection, action, and record

In Java EE in particular, this can be difficult to implement properly. See Bypassing Web Authentication and Authorization with HTTP Verb Tampering for an explanation of this common misconfiguration.

• Do not trust input parameters/objects
• Validate input: length / range / format and type
• Achieve an implicit input validation by using strong types like numbers, booleans, dates, times or fixed data ranges in API parameters
• Constrain string inputs with regexps
• Reject unexpected/illegal content
• Make use of validation/sanitation libraries or frameworks in your specific language
• Define an appropriate request size limit and reject requests exceeding the limit with HTTP response status 413 Request Entity Too Large
• Consider logging input validation failures. Assume that someone who is performing hundreds of failed input validations per second is up to no good.
• Have a look at input validation cheat sheet for comprehensive explanation

• Use a secure parser for parsing the incoming messages. If you are using XML, make sure to use a parser that is not vulnerable to XXE and similar attacks.

A REST request or response body should match the intended content type in the header. Otherwise this could cause misinterpretation at the consumer/producer side and lead to code injection/execution.

• Document all supported content types in your API

Validate request content types

• Reject requests containing unexpected or missing content type headers with HTTP response status 406 Unacceptable or 415 Unsupported Media Type

• For XML content types ensure appropriate XML parser hardening, see the cheat sheet

• Avoid accidentally exposing unintended content types by explicitly defining content types e.g. Jersey (Java) @consumes('application/json'); @produces('application/json'). This avoids XXE-attack vectors for example.

Send safe response content types

It is common for REST services to allow multiple response types (e.g. 'application/xml' or 'application/json', and the client specifies the preferred order of response types by the Accept header in the request.

• Do NOT simply copy the Accept header to the Content-type header of the response.
• Reject the request (ideally with a 406 Not Acceptable response) if the Accept header does not specifically contain one of the allowable types.

Services including script code (e.g. JavaScript) in their responses must be especially careful to defend against header injection attack.

• ensure sending intended content type headers in your response matching your body content e.g. 'application/json' and not 'application/javascript'

• Avoid exposing management endpoints via Internet.
• If management endpoints must be accessible via the Internet, make sure that users must use a strong authentication mechanism, e.g. multi-factor.
• Expose management endpoints via different HTTP ports or hosts preferably on a different NIC and restricted subnet.
• Restrict access to these endpoints by firewall rules or use of access control lists.

• Respond with generic error messages - avoid revealing details of the failure unnecessarily
• Do not pass technical details (e.g. call stacks or other internal hints) to the client

• Write audit logs before and after security related events
• Consider logging token validation errors in order to detect attacks
• Take care of log injection attacks by sanitising log data beforehand

To make sure the content of a given resources is interpreted correctly by the browser, the server should always send the Content-Type header with the correct Content-Type, and preferably the Content-Type header should include a charset. The server should also send an X-Content-Type-Options: nosniff to make sure the browser does not try to detect a different Content-Type than what is actually sent (can lead to XSS).

Additionally the client should send an X-Frame-Options: deny to protect against drag'n drop clickjacking attacks in older browsers.

CORS

Cross-Origin Resource Sharing (CORS) is a W3C standard to flexibly specify what cross-domain requests are permitted. By delivering appropriate CORS Headers your REST API signals to the browser which domains, AKA origins, are allowed to make JavaScript calls to the REST service.

• Disable CORS headers if cross-domain calls are not supported
• Be as specific as possible and as general as necessary when setting the origins of cross-domain calls

In Spring Boot (Java), for example, CORS support is disabled by default and is only enabled once the endpoints.cors.allowed-origins property has been set. The configuration below permits GET and POST calls from the example.com domain:

endpoints.cors.allowed-origins=https://example.com

endpoints.cors.allowed-methods=GET,POST

RESTful web services should be careful to prevent leaking credentials. Passwords, security tokens, and API keys should not appear in the URL, as this can be captured in web server logs, which makes them intrinsically valuable.

• In POST/PUT requests sensitive data should be transferred in the request body or request headers
• In GET requests sensitive data should be transferred in an HTTP Header

OK:

• https://example.com/resourceCollection/<id>/action
• https://twitter.com/vanderaj/lists

NOT OK:

• https://example.com/controller/<id>/action?apiKey=a53f435643de32 (API Key in URL)

HTTP defines status codes [1].When designing REST API, don't just use 200 for success or 404 for error. Always use the semantically appropriate status code for the response.

Here is a non-exhaustive selection of security related REST API status codes. Use it to ensure you return the correct code.

Status code	Message	Description
200	OK	Response to a successful REST API action. The HTTP method can be GET, POST, PUT, PATCH or DELETE
201	Created	The request has been fulfilled and resource created. A URI for the created resource is returned in the Location header
202	Accepted	The request has been accepted for processing, but processing is not yet complete
400	Bad Request	The request is malformed, such as message body format error
401	Unauthorized	Wrong or no authentication ID/password provided
403	Forbidden	It's used when the authentication succeeded but authenticated user doesn't have permission to the request resource
404	Not Found	When a non-existent resource is requested
406	Unacceptable	The client presented a content type in the Accept header which is not supported by the server API
405	Method Not Allowed	The error for an unexpected HTTP method. For example, the REST API is expecting HTTP GET, but HTTP PUT is used
413	Payload too large	Use it to signal that the request size exceeded the given limit e.g. regarding file uploads
415	Unsupported Media Type	The requested content type is not supported by the REST service
429	Too Many Requests	The error is used when there may be DOS attack detected or the request is rejected due to rate limiting
500	Internal Server Error	An unexpected condition prevented the server from fulfilling the request. Be aware that the response should not reveal internal information that helps an attacker, e.g. detailed error messages or stack traces.
501	Not Implemented	The REST service does not implement the requested operation yet
503	Service Unavailable	The REST service is temporarily unable to process the request. Used to inform the client it should retry at a later time.

Erlend Oftedal - [email protected]
Andrew van der Stock - [email protected]
Tony Hsu Hsiang Chih- [email protected]
Johan Peeters - [email protected]
Jan Wolff - [email protected]
Rocco Gränitz - [email protected]

This quick reference of the REST API of Orthanc isautomatically generated from the source code of Orthanc. Clicking onone of the HTTP methods will open its full OpenAPI documentation.

If you are looking for samples, check out the dedicated FAQentry.

Reference¶

Path	GET	POST	DELETE	PUT	Summary
/changes	GET	DELETE	List changes
/exports	GET	DELETE	List exports
/instances	GET	POST	List the available instances
/instances/{id}	GET	DELETE	Get information about some instance
/instances/{id}/anonymize	POST	Anonymize instance
/instances/{id}/attachments	GET	List attachments
/instances/{id}/attachments/{name}	GET	DELETE	PUT	List operations on attachments
/instances/{id}/attachments/{name}/compress	POST	Compress attachment
/instances/{id}/attachments/{name}/compressed-data	GET	Get attachment (no decompression)
/instances/{id}/attachments/{name}/compressed-md5	GET	Get MD5 of attachment on disk
/instances/{id}/attachments/{name}/compressed-size	GET	Get size of attachment on disk
/instances/{id}/attachments/{name}/data	GET	Get attachment
/instances/{id}/attachments/{name}/is-compressed	GET	Is attachment compressed?
/instances/{id}/attachments/{name}/md5	GET	Get MD5 of attachment
/instances/{id}/attachments/{name}/size	GET	Get size of attachment
/instances/{id}/attachments/{name}/uncompress	POST	Uncompress attachment
/instances/{id}/attachments/{name}/verify-md5	POST	Verify attachment
/instances/{id}/content	GET	Get raw tag
/instances/{id}/export	POST	Write DICOM onto filesystem
/instances/{id}/file	GET	Download DICOM
/instances/{id}/frames	GET	List available frames
/instances/{id}/frames/{frame}	GET	List operations
/instances/{id}/frames/{frame}/image-int16	GET	Decode a frame (int16)
/instances/{id}/frames/{frame}/image-uint16	GET	Decode a frame (uint16)
/instances/{id}/frames/{frame}/image-uint8	GET	Decode a frame (uint8)
/instances/{id}/frames/{frame}/matlab	GET	Decode frame for Matlab
/instances/{id}/frames/{frame}/preview	GET	Decode a frame (preview)
/instances/{id}/frames/{frame}/raw	GET	Access raw frame
/instances/{id}/frames/{frame}/raw.gz	GET	Access raw frame (compressed)
/instances/{id}/frames/{frame}/rendered	GET	Render a frame
/instances/{id}/header	GET	Get DICOM meta-header
/instances/{id}/image-int16	GET	Decode an image (int16)
/instances/{id}/image-uint16	GET	Decode an image (uint16)
/instances/{id}/image-uint8	GET	Decode an image (uint8)
/instances/{id}/matlab	GET	Decode frame for Matlab
/instances/{id}/metadata	GET	List metadata
/instances/{id}/metadata/{name}	GET	DELETE	PUT	Get metadata
/instances/{id}/modify	POST	Modify instance
/instances/{id}/module	GET	Get instance module
/instances/{id}/patient	GET	Get parent patient
/instances/{id}/pdf	GET	Get embedded PDF
/instances/{id}/preview	GET	Decode an image (preview)
/instances/{id}/reconstruct	POST	Reconstruct tags of instance
/instances/{id}/rendered	GET	Render an image
/instances/{id}/series	GET	Get parent series
/instances/{id}/simplified-tags	GET	Get human-readable tags
/instances/{id}/statistics	GET	Get instance statistics
/instances/{id}/study	GET	Get parent study
/instances/{id}/tags	GET	Get DICOM tags
/jobs	GET	List jobs
/jobs/{id}	GET	Get job
/jobs/{id}/cancel	POST	Cancel job
/jobs/{id}/pause	POST	Pause job
/jobs/{id}/resubmit	POST	Resubmit job
/jobs/{id}/resume	POST	Resume job
/jobs/{id}/{key}	GET	Get job output
/modalities	GET	List DICOM modalities
/modalities/{id}	GET	DELETE	PUT	List operations on modality
/modalities/{id}/configuration	GET	Get modality configuration
/modalities/{id}/echo	POST	Trigger C-ECHO SCU
/modalities/{id}/find	(post)	(deprecated) Hierarchical C-FIND SCU
/modalities/{id}/find-instance	(post)	(deprecated) C-FIND SCU for instances
/modalities/{id}/find-patient	(post)	(deprecated) C-FIND SCU for patients
/modalities/{id}/find-series	(post)	(deprecated) C-FIND SCU for series
/modalities/{id}/find-study	(post)	(deprecated) C-FIND SCU for studies
/modalities/{id}/find-worklist	POST	C-FIND SCU for worklist
/modalities/{id}/move	POST	Trigger C-MOVE SCU
/modalities/{id}/query	POST	Trigger C-FIND SCU
/modalities/{id}/storage-commitment	POST	Trigger storage commitment request
/modalities/{id}/store	POST	Trigger C-STORE SCU
/modalities/{id}/store-straight	POST	Straight C-STORE SCU
/patients	GET	List the available patients
/patients/{id}	GET	DELETE	Get information about some patient
/patients/{id}/anonymize	POST	Anonymize patient
/patients/{id}/archive	GET	POST	Create ZIP archive
/patients/{id}/attachments	GET	List attachments
/patients/{id}/attachments/{name}	GET	DELETE	PUT	List operations on attachments
/patients/{id}/attachments/{name}/compress	POST	Compress attachment
/patients/{id}/attachments/{name}/compressed-data	GET	Get attachment (no decompression)
/patients/{id}/attachments/{name}/compressed-md5	GET	Get MD5 of attachment on disk
/patients/{id}/attachments/{name}/compressed-size	GET	Get size of attachment on disk
/patients/{id}/attachments/{name}/data	GET	Get attachment
/patients/{id}/attachments/{name}/is-compressed	GET	Is attachment compressed?
/patients/{id}/attachments/{name}/md5	GET	Get MD5 of attachment
/patients/{id}/attachments/{name}/size	GET	Get size of attachment
/patients/{id}/attachments/{name}/uncompress	POST	Uncompress attachment
/patients/{id}/attachments/{name}/verify-md5	POST	Verify attachment
/patients/{id}/instances	GET	Get child instances
/patients/{id}/instances-tags	GET	Get tags of instances
/patients/{id}/media	GET	POST	Create DICOMDIR media
/patients/{id}/metadata	GET	List metadata
/patients/{id}/metadata/{name}	GET	DELETE	PUT	Get metadata
/patients/{id}/modify	POST	Modify patient
/patients/{id}/module	GET	Get patient module
/patients/{id}/protected	GET	PUT	Is the patient protected against recycling?
/patients/{id}/reconstruct	POST	Reconstruct tags of patient
/patients/{id}/series	GET	Get child series
/patients/{id}/shared-tags	GET	Get shared tags
/patients/{id}/statistics	GET	Get patient statistics
/patients/{id}/studies	GET	Get child studies
/peers	GET	List Orthanc peers
/peers/{id}	GET	DELETE	PUT	List operations on peer
/peers/{id}/configuration	GET	Get peer configuration
/peers/{id}/store	POST	Send to Orthanc peer
/peers/{id}/store-straight	POST	Straight store to peer
/peers/{id}/system	GET	Get peer system information
/plugins	GET	List plugins
/plugins/explorer.js	GET	JavaScript extensions to Orthanc Explorer
/plugins/{id}	GET	Get plugin
/queries	GET	List query/retrieve operations
/queries/{id}	GET	DELETE	List operations on a query
/queries/{id}/answers	GET	List answers to a query
/queries/{id}/answers/{index}	GET	List operations on an answer
/queries/{id}/answers/{index}/content	GET	Get one answer
/queries/{id}/answers/{index}/query-instances	POST	Query the child instances of an answer
/queries/{id}/answers/{index}/query-series	POST	Query the child series of an answer
/queries/{id}/answers/{index}/query-studies	POST	Query the child studies of an answer
/queries/{id}/answers/{index}/retrieve	POST	Retrieve one answer
/queries/{id}/level	GET	Get level of original query
/queries/{id}/modality	GET	Get modality of original query
/queries/{id}/query	GET	Get original query arguments
/queries/{id}/retrieve	POST	Retrieve all answers
/series	GET	List the available series
/series/{id}	GET	DELETE	Get information about some series
/series/{id}/anonymize	POST	Anonymize series
/series/{id}/archive	GET	POST	Create ZIP archive
/series/{id}/attachments	GET	List attachments
/series/{id}/attachments/{name}	GET	DELETE	PUT	List operations on attachments
/series/{id}/attachments/{name}/compress	POST	Compress attachment
/series/{id}/attachments/{name}/compressed-data	GET	Get attachment (no decompression)
/series/{id}/attachments/{name}/compressed-md5	GET	Get MD5 of attachment on disk
/series/{id}/attachments/{name}/compressed-size	GET	Get size of attachment on disk
/series/{id}/attachments/{name}/data	GET	Get attachment
/series/{id}/attachments/{name}/is-compressed	GET	Is attachment compressed?
/series/{id}/attachments/{name}/md5	GET	Get MD5 of attachment
/series/{id}/attachments/{name}/size	GET	Get size of attachment
/series/{id}/attachments/{name}/uncompress	POST	Uncompress attachment
/series/{id}/attachments/{name}/verify-md5	POST	Verify attachment
/series/{id}/instances	GET	Get child instances
/series/{id}/instances-tags	GET	Get tags of instances
/series/{id}/media	GET	POST	Create DICOMDIR media
/series/{id}/metadata	GET	List metadata
/series/{id}/metadata/{name}	GET	DELETE	PUT	Get metadata
/series/{id}/modify	POST	Modify series
/series/{id}/module	GET	Get series module
/series/{id}/ordered-slices	(get)	(deprecated) Order the slices
/series/{id}/patient	GET	Get parent patient
/series/{id}/reconstruct	POST	Reconstruct tags of series
/series/{id}/shared-tags	GET	Get shared tags
/series/{id}/statistics	GET	Get series statistics
/series/{id}/study	GET	Get parent study
/statistics	GET	Get database statistics
/storage-commitment/{id}	GET	Get storage commitment report
/storage-commitment/{id}/remove	POST	Remove after storage commitment
/studies	GET	List the available studies
/studies/{id}	GET	DELETE	Get information about some study
/studies/{id}/anonymize	POST	Anonymize study
/studies/{id}/archive	GET	POST	Create ZIP archive
/studies/{id}/attachments	GET	List attachments
/studies/{id}/attachments/{name}	GET	DELETE	PUT	List operations on attachments
/studies/{id}/attachments/{name}/compress	POST	Compress attachment
/studies/{id}/attachments/{name}/compressed-data	GET	Get attachment (no decompression)
/studies/{id}/attachments/{name}/compressed-md5	GET	Get MD5 of attachment on disk
/studies/{id}/attachments/{name}/compressed-size	GET	Get size of attachment on disk
/studies/{id}/attachments/{name}/data	GET	Get attachment
/studies/{id}/attachments/{name}/is-compressed	GET	Is attachment compressed?
/studies/{id}/attachments/{name}/md5	GET	Get MD5 of attachment
/studies/{id}/attachments/{name}/size	GET	Get size of attachment
/studies/{id}/attachments/{name}/uncompress	POST	Uncompress attachment
/studies/{id}/attachments/{name}/verify-md5	POST	Verify attachment
/studies/{id}/instances	GET	Get child instances
/studies/{id}/instances-tags	GET	Get tags of instances
/studies/{id}/media	GET	POST	Create DICOMDIR media
/studies/{id}/merge	POST	Merge study
/studies/{id}/metadata	GET	List metadata
/studies/{id}/metadata/{name}	GET	DELETE	PUT	Get metadata
/studies/{id}/modify	POST	Modify study
/studies/{id}/module	GET	Get study module
/studies/{id}/module-patient	GET	Get patient module of study
/studies/{id}/patient	GET	Get parent patient
/studies/{id}/reconstruct	POST	Reconstruct tags of study
/studies/{id}/series	GET	Get child series
/studies/{id}/shared-tags	GET	Get shared tags
/studies/{id}/split	POST	Split study
/studies/{id}/statistics	GET	Get study statistics
/system	GET	Get system information
/tools	GET	List operations
/tools/accepted-transfer-syntaxes	GET	PUT	Get accepted transfer syntaxes
/tools/create-archive	POST	Create ZIP archive
/tools/create-dicom	POST	Create one DICOM instance
/tools/create-media	POST	Create DICOMDIR media
/tools/create-media-extended	POST	Create DICOMDIR media
/tools/default-encoding	GET	PUT	Get default encoding
/tools/dicom-conformance	GET	Get DICOM conformance
/tools/dicom-echo	POST	Trigger C-ECHO SCU
/tools/execute-script	POST	Execute Lua script
/tools/find	POST	Look for local resources
/tools/generate-uid	GET	Generate an identifier
/tools/invalidate-tags	POST	Invalidate DICOM-as-JSON summaries
/tools/log-level	GET	PUT	Get main log level
/tools/log-level-dicom	GET	PUT	Get log level for dicom
/tools/log-level-generic	GET	PUT	Get log level for generic
/tools/log-level-http	GET	PUT	Get log level for http
/tools/log-level-jobs	GET	PUT	Get log level for jobs
/tools/log-level-lua	GET	PUT	Get log level for lua
/tools/log-level-plugins	GET	PUT	Get log level for plugins
/tools/log-level-sqlite	GET	PUT	Get log level for sqlite
/tools/lookup	POST	Look for DICOM identifiers
/tools/metrics	GET	PUT	Are metrics collected?
/tools/metrics-prometheus	GET	Get usage metrics
/tools/now	GET	Get UTC time
/tools/now-local	GET	Get local time
/tools/reconstruct	POST	Reconstruct all the index
/tools/reset	POST	Restart Orthanc
/tools/shutdown	POST	Shutdown Orthanc
/tools/unknown-sop-class-accepted	GET	PUT	Is unknown SOP class accepted?

NB: Up to Orthanc 1.8.1, this cheat sheet was manually published as anonline spreadsheet. Thisspreadsheet is still available online for history purpose, but is nowleft unmaintained.