REST API configuration settings

The REST interface is configured in rest.ini. The kernel's settings/rest.ini holds the defaults, ezprestapi adds its provider in its own rest.ini.append.php, and a site overrides in settings/override/rest.ini.append.php. After a change, clear the INI cache (php bin/php/ezcache.php --clear-tag=ini), reload PHP-FPM and restart Exponential Velocity.

[System]
PrefixFilterClass=ezpRestDefaultRegexpPrefixFilter
# the path the REST interface answers below
ApiPrefix=/api

[ApiProvider]
# /api/<prefix>/... is served by this class
ProviderClass[auth]=ezpRestAuthProvider
ProviderClass[help]=expHelpRestProvider
ProviderClass[graphql]=expGraphQLRestProvider
ProviderClass[migration]=expMigrationRestProvider
# added by ezprestapi
ProviderClass[ezp]=ezp7xRestApiProvider
ProviderClass[ezpl]=ezp7xRestApiProvider

[Authentication]
# disabled: every call runs as DefaultUserID (or anonymous); policies still apply
RequireAuthentication=enabled
# ezpRestOauthAuthenticationStyle or ezpRestBasicAuthStyle; API keys work with both
AuthenticationStyle=ezpRestOauthAuthenticationStyle
RequireHTTPS=disabled
DefaultUserID=

[OAuthSettings]
TokenTTL=3600
RefreshTokenTTL=2592000
AllowTokenInQuery=disabled
AllowTokenInBody=enabled
# users need oauth/authorize to authorize an application
AuthorizeRequiresPolicy=enabled
RequirePkceForPublicClients=enabled
RequirePkceForConfidentialClients=disabled
AllowPlainPkce=disabled

[CorsSettings]
# for browser applications on other hosts
Cors=disabled
AllowedOrigins[]

[CacheSettings]
# answers cached per user, for DefaultCacheTTL seconds
ApplicationCache=enabled
ApplicationCacheDefault=enabled
DefaultCacheTTL=600
RouteApcCache=enabled
RouteApcCacheTTL=3600

[DebugSettings]
Debug=disabled

Further groups:

• [ApiKeySettings]: personal API keys: on or off, expiry choices, keys per user, rate limit (RateLimitPerMinute=120), scopes and the scope each route needs. See Personal API keys.
• [<Controller>_CacheSettings] and [<Controller>_<action>_CacheSettings]: ApplicationCache per controller or action.
• [OutputSettings] and [<Controller>_<action>_OutputSettings]: output renderers.
• [RouteSettings]: routes that skip the authentication filter or allow optional authentication.
• [PreRoutingFilters], [RequestFilters], [ResultFilters], [ResponseFilters]: filter classes of your own.

Related pages

• rest.ini
• CORS for the REST API