Configuration

Every setting under DeliveryApiInspector in appsettings.

Every setting is optional. With none, the user groups with the View Delivery API output permission see the API tab, which out of the box is Administrators. See Access.

{
  "DeliveryApiInspector": {
    "Enabled": true,
    "Media": true,
    "UserGroups": []
  }
}

Setting	Default	What it does
`Enabled`	`true`	Shows the API tab. Turn it off to hide the tab and refuse the package’s API on an environment, such as production.
`Media`	`true`	Shows the API tab on media items too.
`UserGroups`	`[]`	The aliases of user groups that see the tab on every item, whatever their permissions. For access kept in code rather than in the backoffice.

The package’s API reads the settings on every request, so a change to appsettings takes effect without a restart. The backoffice decides whether to show the tab when it loads, so reload it to see the tab appear or go.

The Delivery API’s own settings

The inspector reads the Delivery API’s settings to describe the request, and never changes them.

With DeliveryApi:Enabled off, the tab still shows what the API would return, and says that frontends get nothing.
With DeliveryApi:PublicAccess off, or for the draft, the request shows an Api-Key header with a placeholder.
With DeliveryApi:Media:Enabled off, the media tab says so.