Routes reference
This page is for app developers who want the complete list of routes in one table. It is taken from the route table
of ezp7xRestApiProvider::getRoutes() in extension/ezprestapi/classes/rest_provider.php and from
settings/rest.ini. All content paths are relative to /api/ezp/<version> (or the alias prefix /api/ezpl/<version>).
Contents
Content routes
| Route name | Method | Path | v1 | v2 | Controller action |
|---|---|---|---|---|---|
ezpNode | GET | /content/node/<id> | yes | yes | viewContent |
ezpNodeUpdate | POST | /content/node/<id> | no | yes | UpdateContentNode (answers 501 after the permission check) |
ezpList | GET | /content/node/<id>/list(/offset/<n>)(/limit/<n>)(/sort/<key>(/asc|desc)) | yes | yes | list |
ezpChildrenCount | GET | /content/node/<id>/childrenCount | yes | yes | countChildren |
ezpFieldsByNode | GET | /content/node/<id>/fields | yes | yes | viewFields |
ezpFieldByNode | GET | /content/node/<id>/field/<identifier> | yes | yes | viewField |
ezpObject | GET | /content/object/<id> | yes | yes | viewContent |
ezpFieldsByObject | GET | /content/object/<id>/fields | yes | yes | viewFields |
ezpFieldByObject | GET | /content/object/<id>/field/<identifier> | yes | yes | viewField |
ezpNodeCreate | POST | /content/node/create | no | yes | CreateContentNode |
ezpNodeDelete | POST or DELETE | /content/node/delete/<id> | no | yes | DeleteContentNode |
ezpListAtom | GET | /content/node/<id>/listAtom | yes | yes | Atom feed; answers 500, a known issue |
Every content action runs in ezp7xRestContentController, which checks the user's policies on each call.
The authentication route
| Method | Path | Does |
|---|---|---|
POST | /api/auth/v1/oauth/token | exchanges an authorization code or a refresh token for an access token |
The auth prefix belongs to the kernel's ezpRestAuthProvider (rest.ini [ApiProvider] ProviderClass[auth]). The
authorize page itself is a normal site page, /oauth/authorize (OAuth2 authorization code flow).
Query parameters
The request parser of the REST framework (kernel/private/rest/classes/request/http_parser.php) takes three
parameters from the query string:
| Parameter | Used by | Values |
|---|---|---|
ResponseGroups | node, object, field and list reads | a comma-separated list (Metadata,Fields) or ResponseGroups[]=... repeated (Response groups) |
Translation | node, object and field reads | a locale, for example eng-GB (Multilingual content) |
OutputFormat | node and object reads | xhtml (Rendered XHTML output) |
Translation and OutputFormat are carried into the links of the answer, so following a link keeps them.
Scopes for personal API keys
A personal API key needs a scope for each route (rest.ini [ApiKeySettings]):
| Route | Scope |
|---|---|
any GET or HEAD route not listed below | read (DefaultReadScope) |
ezp7xRestContentController_CreateContentNode | publish |
ezp7xRestContentController_UpdateContentNode | edit |
ezp7xRestContentController_DeleteContentNode | remove |
Any other non-GET route is refused for keys until its scope is named
(Personal API keys: scopes). OAuth tokens have no such scopes; the user's
policies decide.
Method mismatches
Since 6.0.15, a route whose path matches but which does not take the method no longer ends the search: the router
tries the next routes and answers 405 with an Allow header only when none takes the method. A refused write
answers 401 or 403, never 405 (Personal API keys, routes).
Related pages
- REST API v1 and v2: the routes
- Errors and status codes
- REST API v1 and v2 for applications
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.