importer: a dataforsyningen: provider for Denmark's token-gated GeoDanmark (R142) #220

New issue

Open

opened 2026-08-24 17:05:52 +00:00 by art-bot · 0 comments

art-bot commented

2026-08-24 17:05:52 +00:00

Collaborator

Denmark (#211) is the only one of the four new countries with a credentialed source, and it
gates the parts of the country the anonymous INSPIRE route cannot supply.

What is behind the token, and why it matters

The anonymous route (https://api.dataforsyningen.dk/ogcapi/features/…, CC BY 4.0) gives
Denmark its mask, land cover, hydrography, place names, addresses and building points.
What it does not give is the transport theme's semantics: roadlink has 2 506 759
features and no class, name or ref; railwaylink and railwaystationarea have
geographicalname null throughout. Those attributes live in GeoDanmark, reached as

https://api.dataforsyningen.dk/GeoDanmark60_NOHIST_GML3_DAF?service=WFS&...&token=<token>

Building footprint polygons (as opposed to Denmark's INSPIRE building points) are behind
the same token.

What this issue must establish first

The catalogue could not answer these, and they decide the shape of the code:

Is a Dataforsyningen/Datafordeler user free and self-service?
Is the credential a long-lived API key (in which case the provider is much simpler
than CLMS — it holds the key and adds it, with no minting step) or a short-lived
session token minted from a username/password?
How is it presented — query parameter, Basic auth, or a header?

The rule regardless of the answer (R142)

The credential lives in conf/secrets.yaml under a named credentials: block and is
documented in conf/secrets.example.yaml and docs/country-dk.md. No token= in a
downloads: URL — the importer's plain GET path cannot carry auth and is the wrong tool
here. Reference implementation: importer/clms.go.

Also: do not hold one token for a whole fetch if it turns out to be short-lived — mint
on demand, the lesson from CLMS.

R8: short-circuit before authenticating. An import that needs no new bytes must succeed with
the endpoint unreachable.

Wire into appConfig, include.go, the fetch phase, and both fetch and list, and
update docs/importer-cli.md for both.

Related but separate: services.datafordeler.dk/GeoDanmarkVektor/GeoDanmark60_NOHIST_GML3/1.0.0/WFS
currently answers HTTP 503 "This service has been deliberately (and temporarily) taken out
of service." Worth re-checking — it may be the intended route rather than the
api.dataforsyningen.dk one.

Denmark (#211) is the only one of the four new countries with a credentialed source, and it gates the parts of the country the anonymous INSPIRE route cannot supply. ## What is behind the token, and why it matters The anonymous route (`https://api.dataforsyningen.dk/ogcapi/features/…`, CC BY 4.0) gives Denmark its mask, land cover, hydrography, place names, addresses and building **points**. What it does **not** give is the transport theme's semantics: `roadlink` has 2 506 759 features and no class, name or ref; `railwaylink` and `railwaystationarea` have `geographicalname` null throughout. Those attributes live in **GeoDanmark**, reached as ``` https://api.dataforsyningen.dk/GeoDanmark60_NOHIST_GML3_DAF?service=WFS&...&token=<token> ``` Building **footprint polygons** (as opposed to Denmark's INSPIRE building points) are behind the same token. ## What this issue must establish first The catalogue could not answer these, and they decide the shape of the code: 1. Is a Dataforsyningen/Datafordeler user **free and self-service**? 2. Is the credential a **long-lived API key** (in which case the provider is much simpler than CLMS — it holds the key and adds it, with no minting step) or a **short-lived session token** minted from a username/password? 3. How is it presented — query parameter, Basic auth, or a header? ## The rule regardless of the answer (R142) The credential lives in `conf/secrets.yaml` under a named `credentials:` block and is documented in `conf/secrets.example.yaml` and `docs/country-dk.md`. **No `token=` in a `downloads:` URL** — the importer's plain GET path cannot carry auth and is the wrong tool here. Reference implementation: `importer/clms.go`. Also: **do not hold one token for a whole fetch** if it turns out to be short-lived — mint on demand, the lesson from CLMS. R8: short-circuit before authenticating. An import that needs no new bytes must succeed with the endpoint unreachable. Wire into `appConfig`, `include.go`, the fetch phase, and **both** `fetch` and `list`, and update `docs/importer-cli.md` for both. Related but separate: `services.datafordeler.dk/GeoDanmarkVektor/GeoDanmark60_NOHIST_GML3/1.0.0/WFS` currently answers **HTTP 503 "This service has been deliberately (and temporarily) taken out of service."** Worth re-checking — it may be the intended route rather than the `api.dataforsyningen.dk` one.

art-bot self-assigned this

2026-08-24 17:05:52 +00:00

art-bot referenced this issue

2026-08-24 17:08:46 +00:00

Denmark roads: CVF (anonymous, named, coarse class) vs GeoDanmark Vejmidte (token, full class) #231

art-bot referenced this issue

2026-08-24 17:08:47 +00:00

Denmark rail and stations: Banedanmark's ArcGIS Hub (licence unasserted — R2 first) #232

art-bot referenced this issue

2026-08-24 17:09:36 +00:00

Denmark: building_points (not buildings), airports, and the transit question #234

art-bot referenced this issue from a commit