OpenAPI Explorer

Generates an OpenAPI 3 specification for the HTTP routes your Drupal site exposes, and renders it as browsable documentation with an interactive request tester.

The model is built from three sources, in order of authority:

1. Route discovery — the router and the REST resource plugins
   provide the paths, HTTP methods, authentication providers and owning module.
2. Reflection — the class and method behind each route give the
   {token} path parameters and a best-effort scan for the query
   keys the code reads.
3. Docblock annotations — everything that cannot be inferred
   from the code: summaries, parameter types, request and response schemas,
   examples.

Each operation is reported as annotated, partial or
none, so a team can see at a glance how much of its API is actually
described.

Requirements

This module requires no other modules. It uses only Drupal core services and
the Symfony components core already ships.

These modules are optional. When present, the module reads their real
configuration instead of assuming anything:

• REST (core) — to document routes served by REST resource
  plugins.
• Basic Auth (core) — adds the basic_auth security scheme.
• Key auth adds the key_auth scheme, using the header name that module
  is configured with.
• Simple OAuth adds the oauth2 scheme, using that module's real token
  endpoint.
• JWT adds the jwt_auth scheme. Its jwt_auth_issuer submodule also gives the tester a token
  endpoint to fetch from.

Installation

Install as you would any contributed Drupal module. See Installing modules for further information.

Configuration

Visit Configuration › Web services › API documentation to browse the documentation, and its Settings tab to control
what is documented.

• Which modules to scan — either pick whole extension sources (custom, contributed, profile, core) or tick individual modules.
• Path prefixes — one per line, for example /api. Only routes under one of these prefixes are documented.
  Leave the list empty to document every route on the site,
  which combined with selecting every source gives a complete picture of the
  APIs a site exposes.
• Include REST resources / Include administrative routes — administrative pages are excluded by default, being rarely part of an API.
• Maximum number of endpoints — discovery stops once this
  many endpoints have been found, which keeps the page responsive on a
  site-wide scan. Set it to 0 for no limit.
• Docblock tag prefix — see below.
• JWT header name — the header a JSON Web Token is sent in,
  used by the tester and written into the specification. This cannot be
  detected, so it is configured: leave it as Authorization
  unless your site reads another header.
• Drupal's JWT module accepts JWT-Authorization as well, and some sites patch it to require that one.
• Specification metadata — the title, version, description
  and server URLs written into the generated specification. An empty title
  uses the site name.
• Interactive tester — turn off to render documentation only.