Core API
The Core REST API is available from QUIQQER Core 2.34. It requires quiqqer/rest and an enabled OAuth integration. Complete Setup and Authentication before calling these resources.
All paths below are relative to /api/quiqqer/core with the default REST base path. For example, /users means https://www.example.com/api/quiqqer/core/users. See Requests and Responses for JSON bodies, pagination, and bulk actions.
IDs and Languages
Use IDs returned by the API. User and group resources accept numeric IDs or UUIDs. Site and media IDs are positive integers. {project} identifies a project by name; {lang} identifies an existing language in that project. URL-encode path values where necessary.
Sites and project permissions include the language in the path. Media, project settings, custom CSS, and custom JavaScript are shared across project languages and therefore use paths without {lang}.
Request Schemas
The REST server supplies the Core OpenAPI definition and an HTML API reference at these paths, relative to the installation host:
/api/docs/QuiqqerCore/json
/api/docs/QuiqqerCore/htmlReplace /api if the installation uses another REST base path. Use the installed definition for request fields, required parameters, and response schemas.
Users
Bulk activation and deactivation take userIds. Invitations take email and optionally groupIds. Password and authenticator operations have their own routes.
| Methods | Path |
|---|---|
| GET, POST | /users |
| POST | /users/activate |
| POST | /users/deactivate |
| POST | /users/invite |
| GET, PATCH, DELETE | /users/{userId} |
| GET, POST | /users/{userId}/addresses |
| GET, PATCH, DELETE | /users/{userId}/addresses/{addressId} |
| GET | /users/{userId}/authenticators |
| POST | /users/{userId}/authenticators/{authenticator}/disable |
| PUT | /users/{userId}/default-address |
| PUT | /users/{userId}/password |
| POST | /users/{userId}/password/reset |
| DELETE | /users/{userId}/webauthn-credentials/{credentialId} |
Groups and Memberships
Group activation and deactivation take groupIds. PUT and DELETE on a user-group association add and remove that membership.
| Methods | Path |
|---|---|
| GET, POST | /groups |
| POST | /groups/activate |
| POST | /groups/deactivate |
| GET, PATCH, DELETE | /groups/{groupId} |
| GET | /groups/{groupId}/users |
| GET | /users/{userId}/groups |
| PUT, DELETE | /users/{userId}/groups/{groupId} |
Projects and Settings
PATCH on a project renames it. Use the settings resource for project configuration; GET returns available keys and their value types. CSS and JavaScript use separate resources.
| Methods | Path |
|---|---|
| GET | /languages |
| GET | /project-templates |
| GET | /project-templates/demo-data |
| GET, POST | /projects |
| GET, PATCH, DELETE | /projects/{project} |
| GET, PUT | /projects/{project}/custom-css |
| GET, PUT | /projects/{project}/custom-javascript |
| POST | /projects/{project}/default-structure |
| GET, POST | /projects/{project}/languages |
| GET, PATCH | /projects/{project}/settings |
Sites
Collection actions take siteIds for activation and deactivation. Copies, moves, links, sorting, and locks use the selected site as their action target.
| Methods | Path |
|---|---|
| GET | /projects/{project}/site-layouts |
| GET, POST | /projects/{project}/{lang}/sites |
| POST | /projects/{project}/{lang}/sites/activate |
| POST | /projects/{project}/{lang}/sites/deactivate |
| GET, PATCH, DELETE | /projects/{project}/{lang}/sites/{siteId} |
| POST | /projects/{project}/{lang}/sites/{siteId}/cache/clear |
| POST | /projects/{project}/{lang}/sites/{siteId}/cache/create |
| POST | /projects/{project}/{lang}/sites/{siteId}/copy |
| PUT, DELETE | /projects/{project}/{lang}/sites/{siteId}/language-links/{targetLang} |
| POST | /projects/{project}/{lang}/sites/{siteId}/link |
| GET, POST | /projects/{project}/{lang}/sites/{siteId}/lock |
| POST | /projects/{project}/{lang}/sites/{siteId}/move |
| POST | /projects/{project}/{lang}/sites/{siteId}/sort |
| PUT | /projects/{project}/{lang}/sites/{siteId}/type |
| POST | /projects/{project}/{lang}/sites/{siteId}/unlink |
| POST | /projects/{project}/{lang}/sites/{siteId}/unlock |
| GET | /site-types |
| GET | /sites/resolve |
Media
POST on the media collection uploads a multipart file. Use /folders to create a folder, PATCH to edit metadata, and PUT on /content to replace a file. GET .../size?force=true recalculates a folder size; without force, it reads the cached value.
| Methods | Path |
|---|---|
| GET, POST | /projects/{project}/media |
| POST | /projects/{project}/media/activate |
| POST | /projects/{project}/media/deactivate |
| POST | /projects/{project}/media/folders |
| GET, PATCH, DELETE | /projects/{project}/media/{fileId} |
| GET, PUT | /projects/{project}/media/{fileId}/content |
| POST | /projects/{project}/media/{fileId}/copy |
| GET, PATCH | /projects/{project}/media/{fileId}/effects |
| POST | /projects/{project}/media/{fileId}/move |
| PUT | /projects/{project}/media/{fileId}/order |
| GET, PUT | /projects/{project}/media/{fileId}/preview |
| GET | /projects/{project}/media/{fileId}/size |
| POST | /projects/{project}/media/{fileId}/variants |
| PUT | /projects/{project}/media/{fileId}/visibility |
Upload Sessions
Create a session, transfer the complete file, then finalize it. See Upload Sessions for authentication, expiration, and retry behavior.
| Methods | Path |
|---|---|
| POST | /projects/{project}/media/uploads |
| GET | /projects/{project}/media/uploads/{uploadId} |
| PUT | /projects/{project}/media/uploads/{uploadId}/content |
| POST | /projects/{project}/media/uploads/{uploadId}/finalize |
Permissions
PATCH requests use a permissions object. Permission administration additionally requires the normal QUIQQER permission-management rights. Delegated administrators cannot grant rights beyond their permitted scope.
| Methods | Path |
|---|---|
| GET, PATCH | /groups/{groupId}/permissions |
| GET | /permissions |
| GET, PATCH | /projects/{project}/media/{fileId}/permissions |
| GET, PATCH | /projects/{project}/{lang}/permissions |
| GET, PATCH | /projects/{project}/{lang}/sites/{siteId}/permissions |
| GET, PATCH | /users/{userId}/permissions |
| GET | /users/{userId}/permissions/effective |
Trash
Restore, destroy, and clear are explicit POST actions. Destroy and clear permanently remove trash entries. Media actions use fileIds, and site actions use siteIds; clear acts on the trash collection. Inspect each returned item status.
| Methods | Path |
|---|---|
| GET | /projects/{project}/media/trash |
| POST | /projects/{project}/media/trash/clear |
| POST | /projects/{project}/media/trash/destroy |
| POST | /projects/{project}/media/trash/restore |
| GET | /projects/{project}/{lang}/sites/trash |
| POST | /projects/{project}/{lang}/sites/trash/clear |
| POST | /projects/{project}/{lang}/sites/trash/destroy |
| POST | /projects/{project}/{lang}/sites/trash/restore |
Virtual Hosts
Use the configured host value for {host}. Virtual-host changes affect request routing for the installation.
| Methods | Path |
|---|---|
| GET, POST | /vhosts |
| GET, PATCH, DELETE | /vhosts/{host} |
Forwardings
Use the id returned by the API for {forwardingId}. PATCH changes a forwarding target or HTTP status.
| Methods | Path |
|---|---|
| GET, POST | /forwardings |
| GET, PATCH, DELETE | /forwardings/{forwardingId} |
System
Update preparation and starting return HTTP 202. Read the update resource to inspect progress. Starting an update changes the installation; grant these operations only to accounts that manage system maintenance.
| Methods | Path |
|---|---|
| POST | /system/cache/clear |
| GET | /system/info |
| GET, POST | /system/updates |
| GET | /system/updates/active |
| POST | /system/updates/prepare |
| GET | /system/updates/{updateId} |
| POST | /system/updates/{updateId}/cancel |