What the APIs do not do
This page is for app developers and the people who plan an app with them. Read it before you design screens and estimate work: each gap below was checked in the code, and each has a way around it. Nothing here is a reason not to build an app; it is a list of things to plan instead of discovering them in the last sprint.
Contents
The REST API
| Gap | Evidence | Way around it |
|---|---|---|
| No search route | the route table of ezp7xRestApiProvider has none | expsearch::search (Searching content) |
| Images come as the original file path only | attributeOutputData() cuts the ezimage string at | | expimage::url for an alias (Images in REST answers) |
| Rich text comes as plain text | ezxmltext values pass through strip_tags() | OutputFormat=xhtml with a site template, or your own endpoint (Rich text in apps) |
listAtom answers 500 at v1 and v2 | Known issue: listAtom | the list route |
| No list of drafts or versions | only published content is read | expservices version services, as an editor (Drafts, preview and publishing) |
| No filter by class in a list | the list route takes offset, limit and sort only | expnode::byClass or expnode::children with a filter |
| Sort order must follow paging in the URL | the route's regular expression: list(/offset/<n>)(/limit/<n>)(/sort/<key>(/asc|desc)) | build URLs in that order (Listing children and pagination) |
Authentication
| Gap | Evidence | Way around it |
|---|---|---|
The token endpoint needs client_secret | doHandleRequest() requires grant_type, client_id, client_secret | keep the secret on a server of yours (A back end for your app) |
| Only two grants | authorization_code and refresh_token (validateGrantType()) | no password grant, no client credentials grant; use the code flow |
| No PKCE | the token endpoint reads no code_verifier | the back end holds the secret and does the exchange |
state is not returned | the authorize view: "state, not implemented yet" | keep your own correlation value in the app or back end |
| Personal API keys are personal | made by one user at My account > API access, shown once | never ship one in an app (Personal API keys for tools) |
Browsers and web apps
| Gap | Evidence | Way around it |
|---|---|---|
| No CORS headers | neither the REST framework, ezjscore nor expservices sends Access-Control-* headers | serve the web app from the same origin, or add the headers in the web server or a proxy (Web apps, CORS and CSP) |
| The service worker is for site pages | /index.js caches only same-origin GET navigations without a session cookie | an app needs its own offline store (Syncing and offline reading) |
Native apps are not browsers and are not affected by CORS.
Things outside the APIs
- No mobile SDK. Write a thin client of your own around the routes you use; the expservices reference has starting points for Kotlin and Swift that its authors could not compile on their build machine, so compile them in your project first.
- No push notifications. Nothing in the APIs sends messages to devices. Content events on the server can call your push service through a workflow event or a listener written by an application creator (Workflows, triggers and events).
- No uploads. Neither REST nor expservices documents a way to send an image or file from a device. REST takes a
file value only as a public
http(s)URL that the server downloads (ezprestapi1.2.9). expservices refuses remote writes toezimage,ezbinaryfile,ezmedia,ezuser,ezpasswordandezflowblockfields (Files and uploads). - No change feed. There is no "everything changed since" route for the whole tree; see Syncing and offline reading for what there is.
How to report a gap
If a gap blocks your app, report it with the route, the request, the answer and what you expected. The help's Report an error page and When something goes wrong say where. Until it is closed, an application creator can add the route to your installation (Your own REST provider).
Related pages
- Which API for your app
- REST API v1 and v2 for businesses: known gaps
- Mobile app developers FAQ
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.