v0.4.4 — Destatis GENESIS connector repaired

Fixed: the Destatis GENESIS connector has been broken since June 2025

Destatis permanently switched off GET requests carrying credentials in the URL on 30 June 2025. The connector was still configured that way, so all four of its tools returned the GENESIS HTML web interface instead of JSON. It now uses POST with credentials in HTTP header fields, form-urlencoded bodies, and the current genesis.destatis.de host.

API token support. GENESIS issues a personal 32-character API token that identifies you without a password. One field, DESTATIS_USERNAME_OR_TOKEN, accepts either that token or your Nutzerkennung; DESTATIS_PASSWORD is now optional and is only needed for the classic account.

Existing installs must be re-installed, not re-synced. Catalogue re-sync updates tool definitions, instructions and config, but never a connector's authentication type or base URL. A re-synced old Destatis connector would end up with POST tools still sending credentials as URL parameters, and would report itself up to date. Remove it and install it again from the store.

Corrections found by running it against a real account

• Searches containing an umlaut returned nothing at all. The form body is UTF-8 percent-encoded, but the media type alone does not declare a charset, so GENESIS decoded it as latin-1: Bevölkerung came back as a successful response with zero results. Not an error, a wrong answer.
• destatis_list_statistics filters by statistic code, not by keyword. Its parameter is now named selection and documented as the code pattern it is (122*), and the call no longer returns a permanent Code 22 warning.
• destatis_login_check no longer echoes your API token. The endpoint returns the caller's credential verbatim in Username, where every other GENESIS endpoint masks it. The tool now reports isGuest instead, so the token stays out of the model's context and out of the invocation log.
• A new destatis_login_check tool tells you which account the API is answering as. Worth running first: find/find is a public service that answers identically with or without credentials, so it can never reveal a credential problem.

Platform changes that came out of it

• A configured Content-Type survives on form-urlencoded bodies. The REST engine used to overwrite it after building the body, so an adapter could not declare its charset. The default is now filled in only when nothing configured one.
• Adapters can declare a healthcheck path. "Test connection" probes GET / unless told otherwise, and plenty of APIs answer that with 404, which the UI reports as a broken connector on a healthy install.
• Adapters can declare optional credentials via optionalEnvVars: prompted in the install modal with an "(optional)" label, never blocking Import, and submitted as an empty value rather than leaving the placeholder in the request.
• An explicitly empty credential now resolves to empty instead of falling back to the literal {{VAR}} placeholder. This affected every adapter, latent until one needed a header that had to be present but blank.

Upgrading

No migration and no configuration change. Self-hosted:

docker compose pull && docker compose up -d