Web API

Web API gives a Drupal site a documented, authenticated API for other applications to read its content.

What it sets up

• JSON:API served from /api, and read-only. Write operations stay a decision for the site owner, at /admin/config/services/jsonapi. Read-only is what the Drupal Security Team recommends, because past JSON:API advisories had their root cause in write handling.
• Authentication and authorization: OAuth 2.0 with Simple OAuth and consumers, and HTTP Basic authentication.
• Documentation: OpenAPI documents for JSON:API and REST, rendered with Swagger UI at /api-docs.
• Settings at /admin/config/services/webapi: which entity types expose their new bundles automatically, and whether the View JSON and View API documentation links appear in entity operations.

Install

Composer runs inside DDEV, so nothing is needed on your machine but DDEV itself:

ddev composer require drupal/webapi
ddev drush en webapi

Enabling the module applies its default recipe, which installs and configures everything above.

Good to know

• Every package comes from drupal.org. The Swagger UI asset library belongs to the project template, where Composer installer paths take effect.
• Cross-origin requests are not configuration: set cors.config in sites/default/services.yml per site. No module can ship it.
• Web API is used by the Webships Starter and WebAPI Starter site templates.