This project is not covered by Drupal’s security advisory policy.
Web API gives a Drupal site a documented, authenticated API for other applications to read its content.
What it sets up
- JSON:API served from
/api, and read-only. Write operations stay a decision for the site owner, at/admin/config/services/jsonapi. Read-only is what the Drupal Security Team recommends, because past JSON:API advisories had their root cause in write handling. - Authentication and authorization: OAuth 2.0 with Simple OAuth and consumers, and HTTP Basic authentication.
- Documentation: OpenAPI documents for JSON:API and REST, rendered with Swagger UI at
/api-docs. - Settings at
/admin/config/services/webapi: which entity types expose their new bundles automatically, and whether the View JSON and View API documentation links appear in entity operations.
Good to know
- Every package comes from drupal.org. The Swagger UI asset library belongs to the project template, where Composer installer paths take effect.
- Cross-origin requests are not configuration: set
cors.configinsites/default/services.ymlper site. No module can ship it. - Web API is used by the Webships Starter and WebAPI Starter site templates.
Supporting organizations:
Initial building, ongoing maintenance and development
Project information
- Project categories: Administration tools, Content editing experience, Developer tools
- Ecosystem: Drupal Website, Display Builder, UI Suite - Design Systems with Drupal
- Created by rajab natshah on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
