Universal Entity API

Universal Entity API is a plug-and-play Drupal module that exposes deeply structured, normalized JSON APIs for all content entities — ideal for decoupled frontends, mobile apps, and content hubs.

Features

Universal Entity API transforms Drupal into a powerful backend for headless and decoupled architectures. It delivers structured, flexible APIs with deep reference resolution, optional rendering, and OpenAPI documentation — all with minimal setup.

✅ Supported Entity Types:
This module fully supports all core content entity types out of the box:

🧱 Nodes — Articles, pages, and all custom content types

🧩 Paragraphs — Nested reusable components

🖼️ Media — Images, videos, remote media

🏷️ Taxonomy Terms — Categories, tags, vocabularies

🧱 Custom Blocks — Block content of any bundle

📦 Menus — Complete menu trees with fields and hierarchy

⚙️ Config Entities — Basic site settings (site name, logo, theme)

🧭 Layout Builder (beta) — Section layout, blocks, and nested data (under development)

🔗 Key API Endpoints:

• /api/{entity_type}/{bundle}/{id} — Fetch a single entity (node, block, media, term, etc.) with full reference normalization
• /api/node/{bundle}/list — Paginated, sortable node list with filters and field pruning
• /api/block/{bundle}/list — List all custom blocks of a given bundle
• /api/menu/{menu_name}?depth=n — Load full menu tree with fields, weights, and descriptions
• /api/entity-type/list — Discover all available entity types and bundles
• /api/config/basic — Get basic configuration (site name, logo, theme)

✅ Load any entity (node, taxonomy, block, media, etc.) with
/api/{entity_type}/{bundle}/{id} — Works for all core content entities

🛠 Enhancements:

• Deep reference resolution: Paragraphs inside blocks, media inside paragraphs, blocks inside paragraphs
• Field-level filtering via ?fields=title,field_image
• Sorting & pagination: ?sort=-created&page=1&limit=10
• OpenAPI Documentation:
• Schema JSON: /openapi.json
• Interactive Explorer: /api-docs

Post-Installation

After enabling the module, you’re ready to go:

1. Visit /api-docs to explore the endpoints
2. Test with real content via URLs like /api/node/article/1 or /api/block_content/hero_banner/2
3. Access control is handled via Drupal's standard permissions system
4. No config screens — just plug and play, or extend via hooks/services

Additional Requirements

• Drupal 10 or 11 Core
• Layout Builder (optional, for layout structure API)
• Paragraphs module (optional, for nested reusable components)
• Media module (optional, for file/image/video embedding)

Recommended Modules/Libraries

• OpenAPI UI — For alternate Swagger rendering
• Subrequests — Enables batch fetching (experimental)
• Decoupled Router — Helpful for resolving paths and aliases

Similar Projects

Project Difference JSON:API Exposes raw entity structure. Limited in-depth resolution and no rendered output. GraphQL Requires schema definition and specialized clients. Complex for simple use cases. REST UI Basic entity output. Lacks nested reference support and field filtering. Decoupled Router Route-focused. Doesn’t expose full entity data.

Universal Entity API excels at full-entity normalization for frontend-ready JSON with zero configuration.

Supporting this Module

• ⭐ Star on Drupal.org
• 🛠 Submit patches or enhancements
• 🧠 Share documentation and real-world integrations
• 🤝 Apply for co-maintainership if interested

Community Documentation

• 🎥 Live walkthroughs — Coming soon
• 📺 Next.js frontend integration — Planned
• 🧰 GitLab decoupled starter kit — Coming soon
• 📚 Swagger Explorer: /api-docs

🧩 Layout Builder API (Under Development)

• /api/layout/node/{id} — Returns layout sections, components, and inline block data
• Recursively normalizes Paragraphs, Media, and nested Blocks
• Includes structured fields + rendered HTML preview per section
• Great for rendering Layout Builder pages in headless environments

Enabling CORS for Frontend Access

To allow your decoupled frontend (e.g. React, Next.js) to access these APIs, add the following CORS config to your settings.php:

$settings['cors.config'] = [
  'enabled' => TRUE,
  'allowedHeaders' => ['*'],
  'allowedMethods' => ['GET', 'POST', 'OPTIONS'],
  'allowedOrigins' => ['*'], // Replace * with specific domain(s) in production
  'exposedHeaders' => FALSE,
  'maxAge' => 1000,
  'supportsCredentials' => FALSE,
];

💡 You can restrict allowedOrigins to http://localhost:3000, https://yourfrontend.com, etc., for better security in production.