API Member

Create (or register), read, update and delete members, and change a password. Part of the Webservice module since v10.0.0, before it was a separate package

WARNING

Since v10.0.0 the Member API is part of the module. The separate Webservice Member API and Webservice Member Tools API packages are no longer needed and no longer work: remove system/user/addons/reinos_webservice_member_api (or webservice_member_api) and webservice_member_tools_api after updating. The data, the permissions and the responses changed, see below (Breaking change). Forgot password and resend activation (the Member Tools API) are part of the Auth API.

Enable the API

The Member API is off by default. Enable it with Member API in the API settings, then enable the API for a member on the member page. The setting also enables forgot password, reset password and resend activation of the Auth API.

The Member API follows the rules of the member registration and the profile form of ExpressionEngine, but it is an implementation of the Webservice module. After updating ExpressionEngine, check that it still works as you expect.

Endpoints

Method	URL	Endpoint
POST	/webservice/member	create_member
GET	/webservice/member	read_member
PUT / PATCH	/webservice/member	update_member
PUT	/webservice/member/password	update_member_password
DELETE	/webservice/member	delete_member

Enable the API for a member on the member page. The data is given in a data object, see default parameters.

Permissions

The ExpressionEngine permissions of the member apply:

Endpoint	Yourself	Another member
create_member	-	Create members. Without it, it is a registration (see below)
read_member	Always, without data	Access members
update_member	Always, the email and username need your current_password	Edit members
update_member_password	With your current_password	Edit members
delete_member	Not possible	Delete members

A Super Admin can only be changed or deleted by a Super Admin, and the last Super Admin cannot be deleted. Nobody can change their own role.

create_member

Name	Description
username	The username	Required
email	The email address	Required
password	The password, it must match the password rules of ExpressionEngine	Required
password_confirm	When given, it must match the password	Optional
screen_name	The screen name, default the username	Optional
role_id	The primary role, only with the permission Create members. Default: the default role of the member settings. A locked role (e.g. Super Admin) only by a Super Admin	Optional
bio, language, timezone, date_format, time_format, include_seconds	The profile settings	Optional
custom fields	The custom member fields by short name (or m_field_id_1)	Optional
accept_terms	Required for a registration when Require terms of service is on	Optional

Registration

Without the permission Create members (e.g. a visitor without credentials), create_member is a registration with the rules of the member registration of ExpressionEngine:

• Allow members to register must be on, banned or blocked visitors cannot register;
• the member gets the default role, role_id is ignored;
• with Require member account activation the member is pending and gets the activation email (email) or has to be activated by an administrator (manual);
• only the custom fields that are shown on the registration form are saved;
• the administrators get the notification of a new member when that is on;
• the hooks of ExpressionEngine are called: member_member_register_start, member_member_register_errors and member_member_register.

To let visitors register via the API, make the member/create_member endpoint public. It is not public by default: the API has no captcha, so the rate limiting is the only protection against spam registrations.

curl -X POST 'https://your-domain.com/index.php/webservice/member' \
  -H 'Authorization: Bearer <shortkey>' \
  -H 'Content-Type: application/json' \
  -d '{"data":{"username":"john","email":"john@example.com","password":"a-strong-password","role_id":5}}'

read_member

Without data your own profile is returned. With a filter, other members are returned (permission Access members).

Name	Description
member_id	One or more member ids, an array or comma separated	Optional
role_id	One or more role ids	Optional
username, email, screen_name	An exact match	Optional
orderby	member_id (default), username, screen_name, email, join_date or last_visit	Optional
sort	asc (default) or desc	Optional
limit, offset	Paging, default 25, maximum 100	Optional

Every member has member_id, username, screen_name, role_id, role_ids (all roles), join_date, last_visit, total_entries, total_comments, avatar_url, the profile settings and the custom fields. The email, pending_role_id and the custom fields that are not public are only returned for yourself or with Access members. The password, salt and codes are never returned.

update_member

Name	Description
member_id	The member, empty is yourself	Optional
screen_name, bio, language, timezone, date_format, time_format, include_seconds	The profile settings	Optional
email	The new email address. For yourself the current_password is needed	Optional
username	The new username. For yourself only when Allow members to change their username is on, with the current_password	Optional
current_password	Your current password, to change your own email or username	Optional
role_id	The primary role of another member	Optional
custom fields	By short name. For yourself only the public fields, like the profile form of ExpressionEngine	Optional

Only the given data is changed.

update_member_password

Name	Description
member_id	The member, empty is yourself	Optional
current_password	Your current password, required for your own password	Optional
password	The new password	Required
password_confirm	When given, it must match the password	Optional

The other sessions of the member are ended.

delete_member

Name	Description
member_id	The member	Required
heir_id	The member that gets the entries and files, required when the member has entries (like in the CP)	Optional

Errors

HTTP status	Description
401	Not logged in (e.g. reading your own profile without credentials)
403	No permission, registration not allowed, your own role, yourself or a Super Admin
404	The member does not exist
422	The data is not valid, errors has a message per field, e.g. {"username": "This field must be unique."}

Hooks

webservice_create_member_start, webservice_create_member_end (member_id), webservice_read_member_end (the members, the return value replaces them), webservice_update_member_end (member_id), webservice_update_member_password_end (member_id) and webservice_delete_member_end (member_id). A registration also calls the hooks of ExpressionEngine, see above.

Changes in v10.0.0

• Part of the module, REST endpoints with the HTTP methods above. search_member is part of read_member.
• The permissions of ExpressionEngine are checked.
• group_id is replaced by role_id (roles since ExpressionEngine 6).
• A registration follows the rules of ExpressionEngine (activation, default role, notifications).
• Deleting a member with entries needs a heir_id.
• Validation errors return a 422 with the errors per field.