Default Parameters

All API methods accept a default set of values: the auth credentials and the data of the method. For example the method create_entry:

{
    "auth": {
        "shortkey": "y63idklo93"
    },
    "data": {
        "channel_name": "news",
        "title": "My entry"
    }
}

For GET and DELETE requests the same values are passed as query parameters: ?auth[shortkey]=y63idklo93&data[entry_id]=1.

Auth

The credentials can be sent via the request headers or via the auth object. When both are given, the auth object is used.

A public endpoint can be called without credentials. When credentials are given on a public endpoint, the request runs as that member, with the same checks as on any other endpoint. Wrong credentials give a 401.

Errors of the module

Status	Message	When
400	Invalid JSON body / No data provided	The body is not valid JSON, or there is no data
401	You are not authorized to use this service	No or wrong credentials, an expired session, or a member that is not added to the module
403	Service is not running	The member is not active
403	This API is not active for this service	The API is not selected for the member
403	This IP (...) has no access / No access	The IP is on the blacklist / the user agent is not allowed
404	The requested endpoint does not exist	The endpoint does not exist or is disabled
429	See rate limiting	Too many calls or failed authentications
500	Internal Server Error	An error in the API, with the details in debug mode

Auth via headers

Available from v10.0.0

Header	Credentials
Authorization: Bearer <shortkey>	A shortkey
Authorization: Basic <base64(username:password)>	Username (or email address) and password
X-Api-Key: <key> and X-Api-Secret: <secret>	The key and secret of a member
X-Session-Id: <session_id>	A session ID, see the Auth API

curl -G 'https://your-domain.com/index.php/webservice/entry' \
  -H 'Authorization: Bearer y63idklo93' \
  --data-urlencode 'data[entry_id]=1'

Sending the credentials via the headers keeps them out of the url and the server logs.

Auth object

The auth object accepts one of the following combinations:

Array
(
  [username] => test
  [password] => testPassword

  OR

  [shortkey] => y63idklo93

  OR

  [key] => 881ffcf82e41db00c3f00710f467e818
  [secret] => 76a7646899af288589c4b69be484879e

  OR

  [session_id] => 054b64e828b876b1192170211314a36f58fffb21
)

The username and password belong together, just like the key and secret. The shortkey and session_id are standalone.

Username note

The username parameter can accept either the username or the email address of the user.

Data

The data object is described on the page of each method. Every method accepts a site_id (default 1).