Story: the REST API
This page is for technical journalists who cover headless content management and integrations. Exponential serves its content over a REST API, and the 6.0.15 line put the two API versions into one extension.
Contents
The story in one paragraph
The README lists "A headless CRUD REST API" among the main features. In Exponential 6.0.15, versions 1 and 2 of the
REST content API come from one extension, ezprestapi: reads answer at v1 and v2, writes (create, update, delete) at
v2 only, and "every read and write checks the user's policies ... whatever the request was authenticated with".
Clients authenticate with an OAuth2 token or a personal API key (REST API v1 and v2).
REST v2 with write support was the headline of 6.0.9 in a 7x press release of 2025
(Earlier press releases and coverage).
Facts you can print
| Fact | Source |
|---|---|
Reads at /api/ezp/v1/... and /api/ezp/v2/...; writes at v2 only | REST API v1 and v2, In short |
Permission checks on every call (content/read, content/create, content/edit, content/remove) | same |
| OAuth2 tokens or personal API keys | same; Personal API keys |
The old ezprestapiprovider extension is deprecated; clients see no change | same |
| The guide's statements were checked on the demonstration server on 15 October 2026 | REST API v1 and v2 |
Since 6.0.15 (ezprestapi 1.2.9, 12 November 2026) the API updates content: each update is a new version in the history | New in 6.0.15: the REST API updates content |
The kernel itself writes the content (expContentWriter); the third-party extension nxc_powercontent is no longer needed | Content from plain values: expContentWriter |
What not to claim
| Do not say | Say instead |
|---|---|
| "GraphQL in Exponential 6" | GraphQL belongs to the Symfony line (Exponential Platform DXP) (Story: Exponential Platform DXP) |
| "Anyone can write through the API" | Writes need authentication and the user's permissions |
| "The API is new" | The API has existed for years; 6.0.15 unifies the versions, adds checks and adds updates |
| "Exponential replaced the REST API" | The routes and answers stay the same; the writes now go through the kernel |
Angles and headline ideas
- "Headless with permissions: every API call checks the user's rights."
- "One API extension, two versions, no breaking change."
- "The core writes the content: one extension fewer, and the API can finally update."
Related pages
- Story: editing content
- Story: security
- Talking points for developers
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.