XML Provisioning

XML provisioning makes changes to a store from an XML file: add and update products, categories, customers, settings, admin users and more. Each tag in the file is one action, such as Product_Add or CategoryProduct_Assign, and the tags run in order from the top of the file.

Use it to set up a new store, move settings between a development and a live store, make bulk changes that a CSV import can’t, or script a change you’ll repeat.

Ways to run provisioning#

The admin import and scheduled tasks skip domain tags, such as User_Add or Store_Create. Use the JSON API for those.

File structure#

Every file starts with a <Provision> tag. Inside it, tags are grouped by what they change:

A file can have more than one container, and each container can hold any number of tags:

<Provision>
    <Store code="STORE_CODE">
        <Category_Add>
            <Code>ale</Code>
            <Name>Ale</Name>
            <Active>Yes</Active>
        </Category_Add>

        <Product_Add>
            <Code>ale-gallon</Code>
            <Name><![CDATA[Ale, gallon jug]]></Name>
            <Price>2.00</Price>
            <Active>Yes</Active>
        </Product_Add>

        <CategoryProduct_Assign category_code="ale" product_code="ale-gallon" />
    </Store>
</Provision>

Tips for writing tags:

• Wrap text that might contain <, > or & in <![CDATA[ ... ]]>.
• Yes/no settings take Yes or No.
• _Add tags fail if the record already exists. Use the _Update tag for existing records; it changes only the settings you include.
• A tag that fails is logged and skipped. The tags after it still run.

Base64-encoded values#

Any tag that takes text can take its value base64 encoded. Add encoding="base64" to the tag and Miva decodes the value before using it. This works for names, descriptions, codes, page templates and any other text setting.

Encode values that are hard to put in XML: HTML, template code with its own <mvt:...> tags, text that contains ]]>, or content another system generates. A base64 value never needs escaping or CDATA.

<Provision>
    <Store code="STORE_CODE">
        <Product_Update code="ale-gallon">
            <Description encoding="base64">PHA+QSBnYWxsb24ganVnIG9mIDxzdHJvbmc+cXVhbGl0eTwvc3Ryb25nPiBhbGUuPC9wPg==</Description>
        </Product_Update>
    </Store>
</Provision>

The description above decodes to <p>A gallon jug of <strong>quality</strong> ale.</p>.

• base64 is the only encoding value. Any other value is logged as an error and the tag is skipped.
• Length limits apply to the decoded value, not the encoded one.
• Encode the text as UTF-8 before base64 encoding it.

Two tags take binary files as base64.

Image_Add uploads an image to filepath and adds it to the store. Without encoding, it adds a file that’s already on the server.

<Image_Add filepath="graphics/00000001/ale.png" encoding="base64">iVBORw0KGgo...</Image_Add>

Icon, inside User_Add or User_Update, sets the admin user’s icon:

<Icon type="base64">iVBORw0KGgo...</Icon>

Examples#

Update products and inventory#

<Provision>
    <Store code="STORE_CODE">
        <Product_Update code="ale-gallon">
            <Name><![CDATA[Ale, gallon jug]]></Name>
            <Price>2.00</Price>
        </Product_Update>

        <InventoryProductSettings_Update product_code="ale-gallon">
            <TrackProduct>Yes</TrackProduct>
            <CurrentStock>500</CurrentStock>
        </InventoryProductSettings_Update>

        <Product_Update code="ale-keg">
            <Price>95.00</Price>
            <Active>No</Active>
        </Product_Update>
    </Store>
</Provision>

Add an SSH key to an admin user#

A domain tag, so run it through Provision_Domain. See Set Up Credentials for creating a user with a key.

<Provision>
    <Domain>
        <User_Update name="MIVA_USERNAME">
            <SSHAuthentication>ssh-rsa AAAA... [email protected]</SSHAuthentication>
        </User_Update>
    </Domain>
</Provision>

Upload in the admin#

1. Go to Settings > Data Management, open the Import/Export tab, and under Import Data select Import Data and Settings in XML Provisioning Format.
2. Drag the file into the window or click Choose File.
3. Start the import. The status shows the line number and the last tag processed, and any messages appear when it finishes, with the line number of the tag that caused them.

What the admin import does with the file:

• Wrapper tags are optional. If the file has no <Provision> tag, the import adds one. If it also has no <Store>, <Domain> or <User> tag, the tags run against the store you’re in. A file of bare store tags works.
• Store tags run only for the current store. A <Store> block with another store’s code is skipped.
• User tags run only for you. A <User login="..."> block for another user is skipped.
• Domain tags are skipped.

Limit which tags an import can run#

To let other admin users import provisioning files without giving them every tag, save an import with an allowed tag list:

1. Go to Settings > Data Management > Import Settings and click New Import.
2. For Import Module, choose XML Provisioning Import.
3. In Allowed Tags, enter the tag names to allow, one per line, for example Product_Update and InventoryProductSettings_Update. Names aren’t case sensitive. Leave it empty to allow every tag.
4. Save. The import appears on the Import/Export tab, and tags not on the list are skipped and logged.

Run on a schedule#

A scheduled task can run a provisioning file from the server on a timer, for example a file an ERP writes every night.

1. Upload the file to the store’s mivadata folder (it isn’t public), for example mivadata/uploads/inventory.xml.
2. Go to Settings > Store Settings, open the Scheduled Tasks tab and click Create New Scheduled Task.
3. For Operation, choose Standard Scheduled Tasks: Import, then for Import choose Import Data and Settings in XML Provisioning Format, or your own saved import with an allowed tag list.
4. Enter the File Name relative to mivadata, such as uploads/inventory.xml, and check Delete File After Import if the file should be removed once it runs.
5. Set the Schedule and Next Run and click Add. To run it now, select the task and click Run Scheduled Task(s).

The same rules as the admin import apply: domain tags are skipped.

Run through the JSON API#

The API token must require a signature and a timestamp, and the function has to be assigned to the token by name; a group doesn’t include it.

{
    "Store_Code": "STORE_CODE",
    "Miva_Request_Timestamp": 1735689600,
    "Function": "Provision_Store",
    "xml": "<Product_Update code=\"ale-gallon\"><Price>2.00</Price></Product_Update>"
}

The response’s data is the list of messages the tags logged. An empty list means every tag ran without a message:

{
    "success": 1,
    "data": [
        {
            "dtstamp": "2026-10-21 09:30:00",
            "lineno": 1,
            "tag": "Product_Update",
            "message": "Product with the code 'ale-gallon' does not exist"
        }
    ]
}

Provisioning file on the server#

Miva runs a file named pre-provide.xml from the root of the mivadata folder on every admin page load before sign-in. It can run store, domain and user tags, so Miva Support uses it for tasks such as password resets and creating admin users on a store that nobody can sign in to.

Signed files#

In Miva releases after 10.13.04, pre-provide.xml must be signed by Miva. Anyone with access to the server’s files could otherwise use it to create an admin user. Miva checks the signature with a public key built into the software, so only Miva can create a file that runs. If you need one, contact Miva Support.

A signed file carries the signature in attributes on the <Provision> tag:

<Provision license="mvdev-XXXXXXXXXXX" timestamp="1755902637" signature="BASE64_SIGNATURE">
    <Domain>
        ...
    </Domain>
</Provision>

Because the signature covers the whole file, any change to it after signing, even whitespace, makes it invalid. Files larger than 128 KB aren’t run.

Stores with a test license (starting with testv- or MVTST-) skip the signature check, so unsigned files still run on internal test systems and Docker images.

After the file runs#

Every file that’s picked up is also recorded in the admin activity log. Messages from the tags are written to pre-provide.log beside it.

Older stores#

On Miva 10.13.04 and older, pre-provide.xml doesn’t need a signature. Those versions also run a provide.xml file after an admin signs in; that file is no longer supported in later releases. Use the admin import or the JSON API instead.

Finding tags#

This page shows a few tags; there are hundreds, for every part of the store and for modules. To find a tag and its settings, search features/prv/mmlsk-prv_ad.mv in the LSK. Store tags are listed in PRV_Action_Provision_Store and domain tags in PRV_Action_Provision_Domain, and each tag’s function, such as PRV_Action_Provision_Store_Product_Add, shows the settings it reads.

You can also export data in provisioning format from Settings > Data Management > Import/Export, for example Export Attributes to XML File or Export User Data to XML File, and use the file as a starting point.