Urls

The webservice is a REST API. All endpoints are available under the url trigger, webservice by default (see CP overview):

https://your-domain.com/index.php/webservice/<api_name>

When index.php is removed from your urls, the endpoints are available without it: https://your-domain.com/webservice/<api_name>.

The url trigger itself (/index.php/webservice/, with the slash at the end) returns {"success": true, "message": "Hello from the Reinos Webservice module!"}, handy to check that the API can be reached.

Endpoints

Each API has its own endpoint, the HTTP method decides which method of the API is called. For example the Entry API:

HTTP method	Url	Method
POST	/index.php/webservice/entry	create_entry
GET	/index.php/webservice/entry	read_entry
PUT	/index.php/webservice/entry	update_entry
DELETE	/index.php/webservice/entry	delete_entry

The Endpoints page in the CP shows all endpoints, with the full url and a cURL example. A disabled or unknown endpoint returns a 404 with the message The requested endpoint does not exist.

Request data

A request needs a data object, see Default parameters, except the endpoints that can be called without it (read_member, read_comment, read_category and read_category_group). Otherwise the response is a 400.

• GET and DELETE: pass the values as query parameters, e.g. ?data[entry_id]=1
• POST and PUT: send a JSON body, e.g. {"data": {"title": "My entry"}}. For POST a form body (application/x-www-form-urlencoded) is also accepted.

Invalid JSON returns a 400.

Response

The response is always JSON with a success and message property. Most methods return the result in data, and many also return a metadata object.

{
    "success": false,
    "message": "You are not authorized to use this service"
}

Output headers and CORS

The output headers that are set in the settings (e.g. Access-Control-Allow-Origin: *) are added to every response, including errors. CORS preflight (OPTIONS) requests get a 204 with only these headers, so also set Access-Control-Allow-Methods and Access-Control-Allow-Headers (e.g. Authorization, Content-Type, X-Session-Id, X-Api-Key, X-Api-Secret). Available from v10.0.0