Setup and Authentication

The Core REST API requires QUIQQER Core 2.34 or later, quiqqer/rest, and an enabled quiqqer/oauth-server.

Install the Packages

Run this command from the QUIQQER installation root:

./console composer require 'quiqqer/rest:^3.3.1' 'quiqqer/oauth-server:^3.9.2'

QUIQQER's Composer integration runs the required setup steps. Check that the operation completed successfully. When setup needs to be repeated after a Core update, run:

./console package --setup=quiqqer/core

Enable OAuth in the OAuth package settings. In the REST settings, verify the base host and base path. The examples in this section use /api, the default base path. Use HTTPS for authenticated requests.

Create an API Token

For unattended integration, use a dedicated active QUIQQER user with the rights needed for that integration.

1. Open the user in the administration interface.
2. Open the API tokens tab.
3. Create a token with a title that identifies the integration.
4. Enable the Core route scopes the integration needs.
5. Store the token in the application's secret configuration.

Core accepts permanent API tokens and expiring OAuth access tokens. Send either as a bearer token:

Authorization: Bearer <token>

Core endpoints do not use browser-session cookies or tokens supplied in query strings for authentication. The token must identify an existing active user.

Route Scopes

A scope uses the registered route pattern, including the Core namespace and excluding the configurable /api base path:

Request	Scope
GET /api/quiqqer/core/users	/quiqqer/core/users
PATCH /api/quiqqer/core/users/42	/quiqqer/core/users/{userId}
POST /api/quiqqer/core/users/activate	/quiqqer/core/users/activate
GET /api/quiqqer/core/projects/demo/de/sites/10	/quiqqer/core/projects/{project}/{lang}/sites/{siteId}

Keep placeholders such as {userId} in the scope; use actual IDs in requests. Enabling a collection scope does not automatically enable its item or action scopes. If the client has additional HTTP-method restrictions, the requested method must also be allowed.

QUIQQER Permissions

Every Core request requires quiqqer.core.rest.canUse. Some resource areas require an additional REST permission:

Permission	Area
quiqqer.core.rest.users.canUse	User administration.
quiqqer.core.rest.groups.canUse	Group administration and membership operations.
quiqqer.core.rest.permissions.canUse	Reading and managing permission assignments.
quiqqer.core.rest.forwardings.canUse	Forwardings.
quiqqer.core.rest.vhosts.canUse	Virtual hosts.
quiqqer.core.rest.system.viewInfo	System information.
quiqqer.core.rest.system.clearCache	Cache clearing.
quiqqer.core.rest.system.updateAllowed	System update operations.

The authenticated user also needs the normal QUIQQER rights for the action and target object. For example, listing users requires quiqqer.admin.users.view; editing a site requires its site edit permission. Some operations require administrator or superuser access. Grant the rights needed for the integration rather than enabling every permission.

Test the Connection

With QUIQQER_REST_TOKEN supplied by your secret configuration, list projects:

curl --fail-with-body \
  --header "Authorization: Bearer ${QUIQQER_REST_TOKEN}" \
  'https://www.example.com/api/quiqqer/core/projects'

Enable /quiqqer/core/projects on the token and grant the user quiqqer.core.rest.canUse before trying this request.

Status	Check
401	The bearer token is missing, invalid, expired, revoked, or does not identify an active user.
403	The route scope, method restriction, or required QUIQQER permission does not allow the request.
404	Verify the configured base path, resource path, project, language, and ID.
503	Verify that a compatible OAuth package is installed and enabled.

See Requests and Responses for request bodies and error formats.