Integration surfaces at a glance
This page is the inventory. It lists every way another system can exchange data with Exponential 6.0.15, as shipped
by the kernel and by the extensions the root composer.json requires. Each row names where the surface lives and
whether it works out of the box or must be switched on. The standards behind each protocol, with their known gaps,
are in API and protocol standards.
Contents
- HTTP APIs
- Feeds, files and protocols
- Server-side surfaces
- Identity, mail, search and payment
- What is not provided
- Checking what an installation has active
HTTP APIs
| Surface | Direction | Protocol and format | Authentication | Where | Default |
|---|---|---|---|---|---|
| REST content API | In and out | HTTP, JSON; /api/ezp/v1/... reads, /api/ezp/v2/... reads, create and delete | OAuth 2.0 token, personal API key, or HTTP basic (AuthenticationStyle) | Kernel framework kernel/private/rest/, routes in ezprestapi | Answers when ezprestapi is active; rest.ini [Authentication] RequireAuthentication=enabled |
| GraphQL API | In and out | HTTP, JSON; /api/graphql per siteaccess; queries, mutations (create, update, translate, publish, delete, move, hide), subscriptions | Session (with the form token for mutations), OAuth 2.0 token, personal API key (scopes graphql:read, graphql:write) | Kernel kernel/classes/graphql/, Setup > GraphQL, exp:graphql:* | graphql.ini [GraphQLSettings] Enabled=disabled: off until switched on (The GraphQL API) |
| GraphQL webhooks | Out | HTTP POST, JSON, signed with HMAC-SHA-256 | A shared secret in the secret store | graphql.ini [GraphQLWebhooks], cronjob part graphqlwebhooks | None configured |
| OAuth 2.0 authorization server | In (credentials) | oauth/authorize, POST /api/auth/v1/oauth/token | Client id and secret, user consent | kernel/private/modules/oauth/, Setup > oAuth admin | Grants authorization_code and refresh_token |
| Personal API keys | In (credentials) | Authorization: Bearer expk_... | The key's owner, limited to its scopes | kernel/apikey/, rest.ini [ApiKeySettings] | ApiKeys=enabled; no role has apikey/create until you give it |
Remote services (expservices) | In and out | JSON over /ezjscore/call/exp<domain>::<method> | Session cookie and form token, or an expt_... token | extension/expservices | expservices.ini [Services] Enabled=enabled |
| ezjscore server functions | In and out | JSON over /ezjscore/call/<server>::<function> | Session, policy ezjscore/call | extension/ezjscore | On; your functions are added by ezjscore.ini |
Feeds, files and protocols
| Surface | Direction | Format | Where | Default |
|---|---|---|---|---|
| RSS, Atom and OPML exports | Out | RSS 1.0, RSS 2.0, Atom, OPML 2.0, Apple Podcasts; /rss/feed/<address> | kernel/classes/ezrssexport.php, Setup > RSS | None configured |
| RSS imports | In | RSS 0.91 to 2.0 | kernel/classes/ezrssimport.php, cronjob rssimport.php | In the global cronjob part |
syndication | Both, installation to installation | XML feeds over SOAP | syndication extension, /syndication/menu | Needs soap.ini EnableSOAP=true |
| SOAP server | In | SOAP 1.1, no WSDL | index_soap.php (soap.php before 6.0.15), lib/ezsoap/ | soap.ini [GeneralSettings] EnableSOAP=false |
| WebDAV | Both | WebDAV class 1 | index_webdav.php (renamed in 6.0.15), kernel/private/classes/webdav/ | webdav.ini [GeneralSettings] EnableWebDAV=false |
Packages (.ezpkg) | Both | Package archives; JSON package format | ezpm.php, Setup > Packages | On |
| CSV import and export | Both | CSV | bin/php/ezcsvimport.php, bin/php/ezcsvexport.php | On |
xrowextract | Both, scheduled | CSV, JSON, XML, .ezpkg; SFTP, FTP, S3, WebDAV, HTTP POST | xrowextract extension, admin Export | Installed with the distribution |
| Collected information export | Out | CSV | infocollector/export/<object id>; bccie extension | On |
Server-side surfaces
| Surface | What it gives an integration | Where |
|---|---|---|
| PHP content API | Create, update, publish, move, hide, remove content the supported way | kernel/classes/ezcontentfunctions.php, eZContentObject, eZContentObjectTreeNode |
CLI scripts and ezexec.php | Run PHP with the kernel loaded, from cron or a deployment | bin/php/ezexec.php, eZScript, bin/php/console |
| Cronjob parts | Scheduled imports and exports | settings/cronjob.ini, runcronjobs.php |
| Workflows and triggers | Run code before or after an operation (publish, checkout, ...) | settings/workflow.ini, Setup > Triggers |
| Event listeners | React to kernel events (cache cleared, state assigned, output) | ezpEvent, site.ini [Event] Listeners[] |
| Notification handlers and transports | Deliver notification events your own way | settings/notification.ini, kernel/classes/notification/ |
| Audit trail sinks | Signed webhook, syslog and mail for recorded events | settings/audit.ini [AuditSink_webhook] |
Content jobs and expqueue | Large operations and background work in batches | content.ini [ContentJobSettings], expqueue extension |
Identity, mail, search and payment
| Surface | Setting | Shipped handlers |
|---|---|---|
| Login handlers | site.ini [UserSettings] LoginHandler[] | standard, LDAP (settings/ldap.ini), textfile (settings/textfile.ini); sevenxUser2fa and social login from sevenx_authentication_2fa |
| Single sign-on handlers | site.ini [UserSettings] SingleSignOnHandlerArray[] | None shipped; class eZ<name>SSOHandler of your own |
| Mail transport | site.ini [MailSettings] Transport, TransportAlias[] | sendmail, smtp, file |
| Search engine | site.ini [SearchSettings] SearchEngine | eZSearchEngine (built in); Solr through the separately installed ezfind |
| Payment gateways | paymentgateways.ini [GatewaysSettings] | ezpaypal extension |
What is not provided
Plan the following as custom work, or choose another approach:
| Not provided | What to do instead |
|---|---|
| An OpenAPI description of the content API | Document your routes in your interface specification (template) |
| XML-RPC | Not implemented; use REST or SOAP |
| SAML or an OpenID Connect provider | Write a login or SSO handler, or put an identity-aware proxy in front (Single sign-on) |
| Content webhooks without GraphQL | The GraphQL webhooks above need the GraphQL end point switched on; otherwise use the audit webhook sink with content.object.publish switched on (Audit webhooks), or a workflow event or event listener of your own |
| Updating content through REST | POST /api/ezp/v2/content/node/<id> checks content/edit and answers 501; update through the GraphQL mutation updateContent, from PHP, or through expservices |
| A message broker connector (AMQP, Kafka) | Publish from a workflow event or a cronjob through a PHP client library you add to your extension |
| An MCP server in the kernel | The kernel repository ships none (AI, job queue and MCP) |
Checking what an installation has active
Run these from the installation root (add --allow-root-user when you are root):
php bin/php/console exp:ini get site.ini/ExtensionSettings/ActiveExtensions # ezprestapi, expservices, xrowextract ...
php bin/php/console exp:ini get rest.ini/Authentication/RequireAuthentication
php bin/php/console exp:ini get expservices.ini/Services/Enabled
php bin/php/console exp:ini get soap.ini/GeneralSettings/EnableSOAP
php bin/php/console exp:ini get webdav.ini/GeneralSettings/EnableWebDAV
php bin/php/console exp:ini get site.ini/UserSettings/LoginHandler
php bin/php/console exp:ini get site.ini/MailSettings/Transport
php bin/php/console exp:ini get site.ini/SearchSettings/SearchEngineFrom outside, two requests show whether the HTTP APIs answer:
curl -s 'https://example.com/ezjscore/call/expsession::whoami?ContentType=json'
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/api/ezp/v1/content/node/2 # 401 without credentialsSetup > RAD (/setup/rad) lists the extension points and the expservices catalog of the installation.
Related pages
- Integrating With Exponential 6.0: the book, from the first API call to troubleshooting
- Choosing an integration surface
- API and protocol standards
- Integrations FAQ for public bodies
- Extension points at a glance
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.