--- a/NEWS	Thu Jul 30 18:17:19 2026 +0200
+++ b/NEWS	Fri Jul 31 18:02:21 2026 +0200
@@ -1,6 +1,7 @@
 Pending changes in the mainline
 ===============================
 
+* Support for saving annotations in orthanc-wsi
 * Fix opening of viewers if Orthanc is not branched at the root of the server
 * Disabled "Expect: 100-continue" HTTP header during LTI registration,
   which is not always properly handled by certain LTI deployments

--- a/Sources/EducationToolbox.cpp	Thu Jul 30 18:17:19 2026 +0200
+++ b/Sources/EducationToolbox.cpp	Fri Jul 31 18:02:21 2026 +0200
@@ -106,7 +106,9 @@
       return "stone-webviewer/index.html?study=" + studyInstanceUid + "&series=" + seriesInstanceUid;
 
     case ViewerType_WholeSlideImaging:
-      return "wsi/app/viewer.html?series=" + seriesId + FormatGetArgument("title", title);
+      return ("wsi/app/viewer.html?series=" + seriesId +
+              FormatGetArgument("project", projectId) +
+              FormatGetArgument("title", title));
 
     case ViewerType_VolView:
       return "volview/index.html?names=[archive.zip]&urls=[../series/" + seriesId + "/archive]";
@@ -128,7 +130,9 @@
   switch (viewer)
   {
     case ViewerType_WholeSlideImaging:
-      return "wsi/app/viewer.html?instance=" + instanceId + FormatGetArgument("title", title);
+      return ("wsi/app/viewer.html?instance=" + instanceId +
+              FormatGetArgument("project", projectId) +
+              FormatGetArgument("title", title));
 
     default:
       throw Orthanc::OrthancException(Orthanc::ErrorCode_NotImplemented);

--- a/Sources/Permissions/AuthenticatedUser.cpp	Thu Jul 30 18:17:19 2026 +0200
+++ b/Sources/Permissions/AuthenticatedUser.cpp	Fri Jul 31 18:02:21 2026 +0200
@@ -28,6 +28,16 @@
 
 #include <SerializationToolbox.h>
 
+/**
+ * The "source" field identifies the plugin that authenticated the
+ * user. Other plugins can use this information to recognize
+ * authentication performed by the Education plugin and access the
+ * associated user identity information. For example, the
+ * "orthanc-wsi" plugin uses it to support the per-user saving of
+ * annotations.
+ **/
+static const char* const FIELD_SOURCE_KEY = "source";
+static const char* const FIELD_SOURCE_VALUE = "orthanc-education";
 
 static const char* const FIELD_ROLE = "role";
 static const char* const FIELD_INSTRUCTOR = "instructor_of";
@@ -39,6 +49,7 @@
 void AuthenticatedUser::Serialize(Json::Value& payload) const
 {
   payload = Json::objectValue;
+  payload[FIELD_SOURCE_KEY] = FIELD_SOURCE_VALUE;
   payload[FIELD_ROLE] = EnumerationToString(role_);
 
   if (hasUserId_)

--- a/Sources/Plugin.cpp	Thu Jul 30 18:17:19 2026 +0200
+++ b/Sources/Plugin.cpp	Fri Jul 31 18:02:21 2026 +0200
@@ -75,7 +75,7 @@
 
 
   /**
-   * Check accesses to static resources of Orthanc or of other
+   * Check accesses to static resources of Orthanc or of other supported
    * plugins. In such a situation, it is not necessary to transfer the
    * authentification payload.
    **/
@@ -87,8 +87,6 @@
 
     // Public resources for the whole-slide imaging viewer
     uri == "/app/libs/jquery.min.js" ||
-    uri == "/wsi/app/viewer.html" ||
-    uri == "/wsi/app/viewer.js" ||
 
     // Public resources for the Stone Web viewer
     uri == "/system" ||   // Stone needs access to system information
@@ -167,6 +165,14 @@
   }
 
   if (path.size() == 3 &&
+      path[0] == "wsi" &&
+      path[1] == "api")
+  {
+    // This is for annotations (new in release 4.0 of the WSI plugin)
+    return AuthorizationStatus_GrantedWithPayload;
+  }
+
+  if (path.size() == 3 &&
       path[0] == "studies" &&
       path[2] == "archive")
   {