JSON:API Flag

Exposes Flag state over JSON:API.

Core JSON:API already exposes flagging entities, so creating and deleting flaggings needs no contrib module. What it cannot do is tell you the flag state of the entity you just asked for. This module adds computed fields so a client fetching an article gets that state in the same response, instead of one filtered request per flag, and adds two endpoints that flag and unflag without assembling a flagging document by hand.

Computed fields

These appear on every content entity, and on user entities, and respect the permissions of the account making the request.

• flaggings_current_user, the flag ids the current user has applied to this entity
• flag_counts_entity, flag id mapped to how many times the entity is flagged
• user_flaggings, on user entities, the flags that user has applied

Endpoints

POST   /jsonapi/flag/{flag}/{entity_id}
DELETE /jsonapi/flag/{flag}/{entity_id}

{flag} takes a flag machine name or a uuid, and {entity_id} an id or a uuid. Both routes accept every authentication provider enabled on the site. POST requires the flag permission and DELETE requires the unflag permission, and the entity being flagged must be viewable by the requesting account.

Before the endpoints will answer

Core sets jsonapi.settings.read_only to TRUE by default, which makes both endpoints return 405. Turning it off affects every JSON:API write on the site, not only this module's, so weigh it rather than flipping it. The README covers this and the rest in full.