logo

This project is not covered by Drupal’s security advisory policy.

Status: alpha / planning. Not ready for production.
Releases before 1.0.0 stable are not covered by the Drupal Security Team.
Do not use pre-stable versions on production sites without your own security review.

What it is

API Studio lets site builders create inbound (write) API endpoints in Drupal without writing code.
An external system (a form tool, Zapier, Make, n8n, a mobile app, a device) sends a JSON request to
/api/v1/{endpoint}. API Studio validates it against a schema you define and saves it to a Drupal entity.

API Studio is about receiving data. It is inbound, not an aggregator:
it does not expose your content as a read API (use JSON:API or Views for that) and it does not call third-party APIs.

Why it exists

  • Core REST or JSON:API POST: the sender decides the entity shape; there is no schema, no per-sender key, no log.
  • ECA with ECA Endpoint: powerful, but you wire validation, mapping, authentication and deduplication by hand.
  • Webhook modules: fixed destination, code required, or still alpha.

API Studio targets the common case with safe defaults.

Features (planned; not all implemented yet)

  • 7-step wizard: endpoint, input fields, destination and mapping, authentication, rules, test, publish.
  • Input schema with clear per-field validation errors (HTTP 422).
  • Explicit field mapping (allow-list): nothing is written that you did not map.
  • API keys per consumer, shown once, stored only as a hash, sent in a header.
  • Rate limiting per key.
  • Request log with redaction and short retention.
  • Built-in tester.
  • Later: HMAC signatures, Idempotency-Key, queue mode, templates.

Security first

  • Authentication is always required; there is no public write endpoint.
  • Created content is unpublished by default.
  • Unknown fields are rejected by default.
  • Request size is limited; keys are accepted only in headers, never in the URL.
  • Sensitive values are never stored in the log.

Never put an API key in code that runs in a visitor's browser. Use keys only from servers or automation tools.
Report security issues privately via the
Drupal Security Team process;
do not post vulnerabilities in the public issue queue.

Requirements

  • Drupal 11.3 or higher, or Drupal 12 (core_version_requirement ^11.3 || ^12). Drupal 10 is not supported.
  • PHP as required by your Drupal core version.
  • Core modules: User, Field.

Similar projects and how they are different

  • Entity Webhook: closest in spirit; API Studio adds an input schema, a wizard, rate limiting, a request log and a tester, and answers validation errors synchronously.
  • ECA (ECA Endpoint): complementary, general-purpose; API Studio is a focused, no-code ingest builder.
  • Webform REST: use it if your destination is a webform.
  • Core REST / JSON:API: entity-level APIs; use them when you need those semantics.

Installation

composer require drupal/api_studio
drush en api_studio

Then go to Configuration > Web services > API Studio and create your first endpoint.
(Available from the first alpha release.)

Contributing

Reviews of the design, the security model and the wizard copy are welcome.

Project information

Releases