XavaPro 8.0 released

• Automatic REST API generation for all JPA entities with OpenAPI and embedded Swagger UI.
• Editions renamed: Professional is now Starter, Enterprise is now Solo, Enterprise for Teams is now Team.
• New modern look and feel for the mobile UI.
• Compatible with Spring Boot 4.1.
• Compatible with Jakarta EE 11, including Jakarta Persistence 3.2 and Jakarta Servlet 6.1.
• Java 17 as baseline. Dropped support for Java 8 and 11.
• New user interface generator for the mobile UI, written in pure Java. Dropped legacy JSP renderer.
• DWR code removed; rewritten to use JavaScript fetch() and Java servlets.
• Removed dependencies on J2EE and Java EE APIs.
• Improved detail view for Users and Modules administration modules.
• LDAP timeout reduced to 5 seconds to improve login experience when LDAP servers are down.
• Msal4j (the library for Microsoft Entra/Azure AD) upgraded to 1.26.0.
• Nimbus JOSE + JWT upgraded to 10.9.1.
• Works with OpenXava 8.0.

Automatic REST API generation

Since v8.0 XavaPro automatically generates and publishes a REST API for all your JPA entities. You do not need to write controllers, DTOs, mappers, or configuration files: just write your domain entities with standard JPA and OpenXava annotations, and the REST API is immediately available.

The generated API includes:

• Full CRUD under plural URLs such as /api/customers.
• An OpenAPI 3 specification and an embedded Swagger UI at /api/.
• JWT authentication using XavaPro users, plus the same role, module, action, and field restrictions as the web UI.
• Pagination, multi-property sorting, and filter operators.
• Respect for @Tab(baseCondition=...), History, email notifications, and multitenancy.
• Configurable CORS for browser-based frontends.

By default, the automatic API is turned off for security. You can easily activate it from the administration user interface without restarting the server.

Go to the Admin folder in your application menu and open the Configuration module. In the configuration form, check the Auto generate API checkbox and click Save:

Once checked, all endpoints under the /api/ path become active immediately. If unchecked, any incoming request to /api/* receives an HTTP 404 response with a JSON body {"error":"API is disabled"}.

XavaPro includes an embedded, offline Swagger UI explorer that allows you to inspect and interactively test every available endpoint directly from your browser.

To access Swagger UI, open the following URL in your browser:

http://localhost:8080/yourapp/api/

From the Swagger UI interface, you can click the Authorize button, paste the JWT (without the Bearer prefix; Swagger UI adds it), explore the JSON schemas of your entities, and execute queries directly against your application.

The raw OpenAPI 3.0 specification in JSON format is available at:

GET /api/openapi.json

The automatic API strictly enforces the same security model defined in XavaPro for the web interface:

• Module access: A user can only access an entity endpoint if their assigned roles have permission to view that module. Accessing a forbidden entity returns HTTP 403.
• Read-only modules: If a module is marked as read-only for the user or their role, only GET requests are permitted. POST, PUT, and DELETE return HTTP 403.
• Action rights: Creating records (POST) requires permission for the new action; updating records (PUT) requires permission for the save action; deleting records (DELETE) requires permission for the delete action.
• Excluded properties: Properties configured as excluded for the user's role are hidden from all GET responses and ignored on POST and PUT.
• Read-only properties: Properties configured as read-only for the user's role are returned in GET responses but ignored during PUT modifications.

You can create a dedicated api role (or multiple API roles) in the Roles module specifically for API consumers. Assigning this role to the API user accounts lets you fine-tune exactly which modules, actions, and fields are accessible through the REST API.

You can find all the details in the documentation.

New names for XavaPro editions

We have renamed the XavaPro editions. They are now:

• The Professional edition is now called Starter.
• The Enterprise edition is now called Solo.
• The Enterprise for Teams edition is now called Team.
• The Corporate edition is still called Corporate.

Prices and conditions remain exactly the same as always. We have only made the names more descriptive.

Modernization under the hood

XavaPro 8.0 evolves alongside OpenXava 8.0, incorporating the same modern and clean technological foundation. It is compatible with Spring Boot 4.1 and Jakarta EE 11, including Jakarta Persistence 3.2 and Jakarta Servlet 6.1, and sets Java 17 as the baseline version, dropping support for Java 8 and 11. The mobile UI gets a more modern look and feel and a new UI generator written in pure Java, replacing the legacy JSP renderer. We have also completely removed DWR and rewritten this part using JavaScript fetch() and Java servlets, as well as removing dependencies on the old J2EE and Java EE APIs. 

Try it yourself

Demo: https://www.openxava.org/xavaprotest (User: demo, Password: demo)

If you want to try the admin features reply to this email asking for the admin password.
If you want to try the mobile features access to above URL using your mobile phone.

To learn more go to the XavaPro page.