API Comment

Post, read, update and delete comments on entries. Part of the Webservice module since v10.0.0, before it was a separate package for ExpressionEngine 2

WARNING

Since v10.0.0 the Comment API is part of the module. The separate Webservice Comment API package (ExpressionEngine 2 only) is discontinued (Breaking change). The Comment module of ExpressionEngine needs to be installed.

Enable the API

The Comment API is off by default. Enable it with Comment API in the API settings, then enable the API for a member on the member page.

The Comment API follows the rules of the comment form of ExpressionEngine, but it is an implementation of the Webservice module. After updating ExpressionEngine, check that it still works as you expect.

Endpoints

Method	URL	Endpoint
POST	/webservice/comment	create_comment
GET	/webservice/comment	read_comment
PUT / PATCH	/webservice/comment	update_comment
DELETE	/webservice/comment	delete_comment

Permissions

The ExpressionEngine permissions of the member apply, like on the site:

Endpoint	Permission
create_comment	Post comments, and the comment settings of the channel and the entry
read_comment	Open comments for everybody who can call the endpoint. Comments with another status, and the email and IP address, need Moderate comments
update_comment	The text: Edit all comments, or your own comment with Edit own comments (within the comment edit time limit). The status: Moderate comments
delete_comment	Delete all comments, or your own comment with Delete own comments

create_comment

A comment is always posted as the member of the request, with its name and email. Without credentials (a public endpoint) it is posted as a guest, when the channel does not require membership.

Name	Description
entry_id	The entry	Required
comment	The comment	Required
notify_me	y to get an email of the new comments on the entry	Optional
name	The name of a guest	Required for guests
email	The email of a guest	Required for guests when the channel requires an email
url, location	The url and location of a guest	Optional
page_url	The url of the page with the comments, used in the notification emails. Default: the comment url (or url) of the channel with the url title	Optional

Like the comment form of ExpressionEngine:

• comments must be allowed for the channel and the entry, and not be expired (with the comment moderation override an expired comment is moderated);
• the comment time lock, the duplicate check, the maximum length and the banned names and emails apply (not for a Super Admin);
• the comment is pending when the channel moderates comments, unless a role of the member is excluded from moderation;
• the spam service of ExpressionEngine checks the comment when the Spam module is installed;
• the notifications of the administrators, the author and the subscribers are sent;
• the hooks of ExpressionEngine are called: insert_comment_start, insert_comment_insert_array and insert_comment_end.

The API has no captcha, the rate limiting protects a public endpoint against spam.

curl -X POST 'https://your-domain.com/index.php/webservice/comment' \
  -H 'Authorization: Bearer <shortkey>' \
  -H 'Content-Type: application/json' \
  -d '{"data":{"entry_id":12,"comment":"Nice article!"}}'

{
  "success": true,
  "message": "Comment posted",
  "metadata": {"id": 5},
  "data": [{"comment_id": 5, "entry_id": 12, "author_id": 4, "name": "John", "comment": "Nice article!", "comment_date": 1792427824, "edit_date": 0, "status": "open"}]
}

The status is open, pending (moderated) or spam.

read_comment

Name	Description
entry_id	One or more entry ids, an array or comma separated	Optional
comment_id	One or more comment ids	Optional
author_id	One or more member ids	Optional
status	o (open, default), c (closed), p (pending), s (spam), comma separated. Other than open needs Moderate comments	Optional
orderby	comment_date (default), comment_id or entry_id	Optional
sort	asc (default) or desc	Optional
limit, offset	Paging, default 25, maximum 100	Optional

update_comment

Name	Description
comment_id	The comment	Required
comment	The new text	Optional
status	open, closed, pending or spam (or o, c, p, s)	Optional

delete_comment

Name	Description
comment_id	The comment	Required

Errors

HTTP status	Description
401	Not logged in (update, delete, or a channel that requires membership)
403	No permission, or comments are not allowed or expired
404	The entry or comment does not exist
422	The data is not valid, errors has a message per field
429	The comment time lock of the channel
501	The Comment module of ExpressionEngine is not installed

Hooks

webservice_create_comment_start, webservice_create_comment_end (comment_id), webservice_read_comment_end (the comments, the return value replaces them), webservice_update_comment_end (comment_id) and webservice_delete_comment_end (comment_id).

Changes in v10.0.0

• Part of the module, for ExpressionEngine 7+, off by default (Comment API in the settings).
• A comment is posted as the member of the request; member_id is not accepted.
• The rules of the comment form of ExpressionEngine apply: roles and permissions, moderation, spam, notifications.
• read_comment only returns open comments without the email and IP address, unless the member can moderate comments. Before, it returned all comments with the email and IP address.
• search_comment is part of read_comment.