GeoServer
Authorized WFS 2.0 layer discovery and bounded feature queries
Vendor ID: geoserver · Maturity: preview · Category: Tools
Connect one GeoServer WFS 2.0 endpoint to discover layers, inspect their fields and query features within a WGS84 bounding box. Results retain the GeoServer vendor identity, stable feature IDs and service attribution when supplied.
Setup and authentication
Set baseUrl to your WFS endpoint, for example https://geo.example.com/geoserver/wfs, without query parameters. Enable WFS 2.0 and JSON output. Explicitly allowlist the endpoint host in organization egress settings. Production access requires HTTPS on port 443 and public DNS resolution; a customer-hosted service must meet the same requirements.
Three endpoint forms are accepted, and all behave the same way:
| Form | Example | Catalog |
|---|---|---|
| Instance | https://geo.example.com/geoserver/wfs | every published layer on the server |
| Workspace virtual service | https://geo.example.com/geoserver/myworkspace/wfs | only that workspace's layers |
| Layer virtual service | https://geo.example.com/geoserver/myworkspace/mylayer/wfs | that single layer |
Prefer a workspace or layer virtual service when you want to expose a subset — it produces a smaller capabilities document and a shorter layer list.
A published layer is skipped from the catalog when its advertised identity cannot be addressed: a name that is not a valid QName (one starting with a digit, or containing a space), an unresolved namespace prefix, a duplicate name, or a missing or overlong CRS. The rest of the server is unaffected, and the number skipped is recorded in the service logs. Describing or querying a skipped layer is refused with INVALID_REQUEST.
A layer whose only problem is an out-of-range WGS84BoundingBox — several public servers advertise values a fraction beyond ±180/±90 — keeps its place in the catalog and is fully queryable; only its reported extent is omitted.
Choose basicAuth for a read-only GeoServer account or none for an anonymous service. Username and password belong in the connection credentials, never URL parameters or extra configuration fields. Access remains limited to the layers authorized for that connection.
Capabilities
| Operation | Behavior |
|---|---|
| List layers | Reads WFS capabilities for the configured service. Discovery is bounded to 500 layers; larger catalogs are refused rather than silently clipped. |
| Describe layer | Reads its feature schema, geometry type, scalar fields and source CRS. External schema imports are not fetched. Unsupported schema structures are refused. |
| Query features | Combines a bounding box with structured attribute filters, selected fields and a limit of up to 500 features. |
Filters support equality, inequality, ordered comparisons, like and in for compatible field types. Raw CQL is not accepted. Queries crossing the antimeridian are split and stable feature IDs are deduplicated. JSON output uses WGS84 longitude/latitude ordering; height values are removed. Unsupported response coordinate systems are refused.
Every query returns truncated. A result with truncated: true is incomplete; use its cursor, when present, with the same source, layer, bounding box, filters, selected fields and limit to continue. Cursors are limited to 4,096 characters. If antimeridian deduplication state cannot fit, the result remains truncated without a cursor; narrow the query area to obtain further results. Internal deduplication is bounded to 1,000 identities. Unknown provider totals trigger a bounded lookahead so an exact final full page can be reported as complete. Provider continuation URLs are never followed. Cursors are for short-lived continuation of live data, not a snapshot guarantee.
Queries are limited by response size, geometry complexity, request count and execution time. Pagination sorts by scalar schema fields, preferring a conventional ID field. Use layers with stable, distinguishing sortable attributes; changing data can affect pagination.
This extension provides live feature queries. Geocoding, routing, tile rendering, bulk export and automatic ingestion are not available. No public service is used as an automatic fallback.