Requests and Responses

These examples use the Core REST API available from Core 2.34, with quiqqer/rest configured at /api. Replace the host, project names, and IDs with values from your installation. Supply QUIQQER_REST_TOKEN through your secret configuration.

HTTP Methods

Method	Purpose	Example
GET	Read a resource or collection.	/users/42
POST	Create a resource or execute an action.	/users/activate
PATCH	Change selected fields.	/users/42
PUT	Set or replace a value, association, or file content.	/users/42/password
DELETE	Remove a resource or association.	/users/42/groups/7

Paths in this table are relative to /api/quiqqer/core. Use the methods listed for the resource in the Core API reference. Unsupported methods return 405 with an Allow header.

JSON Bodies

Send JSON objects with Content-Type: application/json. Unknown fields and incorrect value types are rejected. Use JSON booleans and numbers where the endpoint expects them, rather than string equivalents.

Change a user's first and last name:

curl --fail-with-body --request PATCH \
  --header "Authorization: Bearer ${QUIQQER_REST_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{"firstName":"Alex","lastName":"Example"}' \
  'https://www.example.com/api/quiqqer/core/users/42'

JSON bodies are limited to 1 MiB. Use the file-upload endpoints for binary data.

Success and Error Responses

JSON success responses put the result in data. Paginated collections also include meta:

{
  "data": [],
  "meta": {"total": 0, "limit": 25, "offset": 0}
}

Creation endpoints generally return 201 and a Location header. Operations that return 204 have no response body. Download endpoints return binary content.

Core errors have this structure:

{
  "error": {
    "code": "permission_denied",
    "message": "You do not have permission to perform this operation."
  }
}

Use the HTTP status and error code when handling failures. Common statuses include 409 for a conflicting resource state, 415 for an unsupported content type, and 422 for invalid input. Core responses use Cache-Control: no-store.

Pagination and Search

Paginated collections use limit and offset. The default limit is 25 and the maximum is 100. For example:

GET /api/quiqqer/core/users?search=Alex&limit=25&offset=0
Authorization: Bearer <token>

Site and media collections support parentId to list a parent's children. A non-empty search searches the project resource collection; it is not limited to that parent's children. Sites are scoped to the language in the path. Their pagination totals, and those of media lists, include only readable objects.

Activate Multiple Users

Activation is an action on the collection. Supply one or more IDs in userIds:

curl --fail-with-body --request POST \
  --header "Authorization: Bearer ${QUIQQER_REST_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{"userIds":[42,43]}' \
  'https://www.example.com/api/quiqqer/core/users/activate'

Each entry in the returned data array contains its own id, status, and either data or error. A successful entry also reports changed; activating an already active user returns changed: false.

Inspect every entry even when the response has HTTP status 200. Bulk actions are not atomic: one ID may succeed while another fails. ID lists accept at most 100 entries. Group actions use groupIds, site actions use siteIds, and media actions use fileIds.

Read and Edit Sites

Select the project and content language in the path:

GET /api/quiqqer/core/projects/demo/de/sites/10
Authorization: Bearer <token>

PATCH /api/quiqqer/core/projects/demo/de/sites/10
Authorization: Bearer <token>
Content-Type: application/json

{"title":"Updated title","content":"<p>Updated content.</p>"}

Project settings, custom CSS, custom JavaScript, and media use paths without a language. Project permissions include the language.

Upload and Replace Media

Upload one file with multipart/form-data. Let curl set the multipart boundary:

curl --fail-with-body \
  --header "Authorization: Bearer ${QUIQQER_REST_TOKEN}" \
  --form 'parentId=1' \
  --form 'file=@./document.pdf' \
  'https://www.example.com/api/quiqqer/core/projects/demo/media'

Use application/octet-stream to replace an existing file's content while keeping its media ID:

curl --fail-with-body --request PUT \
  --header "Authorization: Bearer ${QUIQQER_REST_TOKEN}" \
  --header 'Content-Type: application/octet-stream' \
  --data-binary '@./document.pdf' \
  'https://www.example.com/api/quiqqer/core/projects/demo/media/42/content'

Core accepts at most 50 MiB per file. Web-server and PHP upload limits may be lower. A GET request to the content resource downloads the file; for a folder, it returns a ZIP containing readable, registered media. Folder archives are limited to 10,000 entries and 50 MiB of source content.

Upload Sessions

To separate transfer from import:

1. POST /projects/{project}/media/uploads with parentId and filename. Optionally set maxBytes and allowedMimeTypes.
2. Read the returned data.id as the upload ID.
3. PUT /projects/{project}/media/uploads/{uploadId}/content with the complete binary file and Content-Type: application/octet-stream.
4. POST /projects/{project}/media/uploads/{uploadId}/finalize to import it.

These paths are relative to /api/quiqqer/core. Authenticate every request with the same user and enable each required route scope. Sessions are bound to that user and project, expire after one hour, and allow at most five pending uploads per user. Chunked resume is not supported.

Finalizing a completed session again returns the same media item. If an import was interrupted after finalization began, the session reports a conflict. Check the media folder before creating a replacement session.