No. In Drupal 11.4.10 the Standard installation profile does not install the jsonapi module, so you enable it on the Extend page. It is a core module and has been since Drupal 8.7. Do not install the old contributed JSON:API project: its page says it is unsupported because of a security issue.
' - '@type': Question name: 'Can JSON:API create and edit content, or only read it?' acceptedAnswer: '@type': Answer text: 'Both are possible, but core ships in read-only mode: the default configuration sets read_only: true. To allow writing, open /admin/config/services/jsonapi and choose the option that accepts all create, read, update and delete operations. The form warns you to do this only if the site needs it.
' - '@type': Question name: 'What is the difference between JSON:API and the core REST module?' acceptedAnswer: '@type': Answer text: 'JSON:API works only on entities and always speaks JSON. The core REST module can also reach data that is not an entity and can use other formats, but drupal.org notes that it needs considerable setup. The module page describes JSON:API as a zero-configuration way to allow create, read, update and delete operations on a site's content.
' - '@type': Question name: 'How many items does one JSON:API response contain?' acceptedAnswer: '@type': Answer text: 'At most 50. In Drupal 11.4.10 the query code uses 50 as both the default and the maximum for page[limit] and lowers larger values to 50 without an error. Entity access checks can remove items, so a page may hold fewer. Follow the next link in the response to get the rest.
' - '@type': TechArticle headline: 'JSON:API' description: 'A core module that serves Drupal content as JSON in the JSON:API format, shaped by filter, sort, include and paging parameters.' image: '@type': ImageObject url: 'https://dxpr.com/themes/custom/dxpr_com/images/dxpr-share-card.jpg' width: '1200' height: '630' datePublished: '2026-10-26T18:01:04+0000' dateModified: '2026-10-26T18:01:04+0000' author: '@type': Organization '@id': 'https://dxpr.com/#organization' name: DXPR url: 'https://dxpr.com/' logo: '@type': ImageObject url: 'https://dxpr.com/themes/custom/dxpr_com/dxpr-logo-dark.svg' width: '1348' height: '501' publisher: '@type': Organization '@id': 'https://dxpr.com/#organization' name: DXPR url: 'https://dxpr.com/' logo: '@type': ImageObject url: 'https://dxpr.com/themes/custom/dxpr_com/dxpr-logo-dark.svg' width: '1348' height: '501' mainEntityOfPage: 'https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/json-api' articleSection: 'Drupal glossary' - '@type': WebPage '@id': 'https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/json-api' description: 'A core module that serves Drupal content as JSON in the JSON:API format, shaped by filter, sort, include and paging parameters.' breadcrumb: '@type': BreadcrumbList itemListElement: - '@type': ListItem position: 1 name: Home item: 'https://dxpr.com/' publisher: '@type': Organization '@id': 'https://dxpr.com/#organization' name: DXPR inLanguage: en --- [Help Center](/hc)/[Documentation](/hc/documentation) /[Learn Drupal](/hc/documentation/learn-drupal) /[Drupal glossary](/hc/documentation/learn-drupal/drupal-glossary) # JSON:API A core module that serves Drupal content as JSON in the JSON:API format, shaped by filter, sort, include and paging parameters. Learn DrupalDrupal glossary Last updated October 26, 2026 ## In this guide Related terms - [Headless Drupal](/hc/documentation/learn-drupal/drupal-glossary/headless-drupal) - [Entity](/hc/documentation/learn-drupal/drupal-glossary/entity) - [Bundle](/hc/documentation/learn-drupal/drupal-glossary/bundle) - [Entity type](/hc/documentation/learn-drupal/drupal-glossary/entity-type) - [Node](/hc/documentation/learn-drupal/drupal-glossary/node) - [URL](/hc/documentation/learn-drupal/drupal-glossary/url) [All Drupal terms from A to Z](/hc/documentation/learn-drupal/drupal-glossary) JSON:API is a core Drupal module that exposes entities as a web API following the JSON:API specification. Each bundle, such as the Article content type or a vocabulary, gets its own URL under `/jsonapi` that returns JSON. A separate website, mobile app or script can read that content, and with writing switched on, change it. ## How it works in Drupal 11 The module is named `jsonapi`. It depends on the core Serialization and File modules. Its URLs follow one pattern: `/jsonapi/{entity_type_id}/{bundle_id}` for a collection and `/jsonapi/{entity_type_id}/{bundle_id}/{uuid}` for a single item. Articles live at `/jsonapi/node/article`. There is no URL at `/jsonapi/node`, because one path would have to serve several resource types. A request to `/jsonapi` itself returns an entry point that links to the available resources. Requests and responses use the media type `application/vnd.api+json`. The query string does the work that you would otherwise do in code. `filter` limits a collection by field values, `sort` orders it, `include` embeds related entities in the same response, and `page[limit]` and `page[offset]` split large collections into pages. JSON:API adds no access rules of its own. Drupal's entity access and field access are respected, and the validation constraints of the entity apply to write requests. By default the base path is `/jsonapi`; the security guide shows a `jsonapi.base_path` setting in `services.yml` to change it, and files this under security through obscurity that only makes automated attacks less effective. ## Example This request asks for the five newest published articles together with their authors: ```http GET /jsonapi/node/article?filter[status][value]=1&sort=-created&page[limit]=5&include=uid Accept: application/vnd.api+json ``` The response has a `data` array with the articles and an `included` array with the user entities that the `include` parameter asked for. When more articles exist, the response also carries a `next` link. The client follows that link instead of building page URLs on its own. ## Status and add-ons Checked on 26 October 2026: JSON:API has been part of core since Drupal 8.7, and the 8.7.0 announcement calls it a stable core feature. The Drupal 11.4.0 announcement of 1 July 2026 notes that Wim Leers stepped down as maintainer of the module. The contributed JSON:API Extras module changes what the API exposes: it can enable or disable resources, rename them, change their paths and disable fields. Its project page lists release 8.x-3.28 from 19 December 2025, an 8.x-3.29-beta1 from 16 October 2026, and compatibility with Drupal 11. ## Common mistakes - **Requesting a whole entity type.** `/jsonapi/node` does not exist. Name the bundle, as in `/jsonapi/node/article`. - **Expecting business logic.** The drupal.org getting started guide says JSON:API does not support business logic, and names registering a new user account and resetting a password as examples. Plan custom code or the core REST module for those. - **Exposing more than the front end needs.** The security guide says JSON:API has a bigger API surface out of the box, because every entity type that is not internal is exposed. Turn off resource types or fields you do not use, in a custom module or with JSON:API Extras. - **Fetching related items one by one.** A client that loads every author with a second request wastes round trips. The `include` parameter returns them together, and a user shared by several items appears only once. ## For marketing and content teams JSON:API is the reason a [headless Drupal](/hc/documentation/learn-drupal/drupal-glossary/headless-drupal) site can show content you edit in Drupal's own forms. What you save as an [entity](/hc/documentation/learn-drupal/drupal-glossary/entity) is served as it is stored, and the same access rules apply as in the editing interface. When a developer proposes a new app or front end, ask which content types and fields it will read, and whether it will only read or also write. That decides what a site builder must expose and what stays hidden. ## Sources - [Drupal.org: JSON:API module](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module) - [Drupal.org: JSON:API security considerations](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module/security-considerations) - [Drupal.org: JSON:API API overview](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module/api-overview) - [Drupal.org: JSON:API filtering](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module/filtering) - [Drupal.org: JSON:API sorting](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module/sorting) - [Drupal.org: JSON:API includes](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module/includes) - [Drupal.org: JSON:API pagination](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module/pagination) - [Drupal.org: Getting started with JSON:API and REST](https://www.drupal.org/docs/develop/decoupled-drupal/getting-started-with-json-api-and-rest) - [Drupal.org: Drupal 8.7.0 release announcement](https://www.drupal.org/blog/drupal-8-7-0) - [Drupal.org: JSON:API (legacy contributed project)](https://www.drupal.org/project/jsonapi) - [Drupal.org: JSON:API Extras project page](https://www.drupal.org/project/jsonapi_extras) - [Drupal.org: Drupal 11.4.0 is now available](https://www.drupal.org/blog/drupal-11-4-0) - [Drupal core 11.4.10: JSON:API default settings](https://git.drupalcode.org/project/drupal/-/raw/11.4.10/core/modules/jsonapi/config/install/jsonapi.settings.yml) - [Drupal core 11.4.10: JSON:API settings form](https://git.drupalcode.org/project/drupal/-/raw/11.4.10/core/modules/jsonapi/src/Form/JsonApiSettingsForm.php) - [Drupal core 11.4.10: JSON:API entry point controller](https://git.drupalcode.org/project/drupal/-/raw/11.4.10/core/modules/jsonapi/src/Controller/EntryPoint.php) - [Drupal core 11.4.10: jsonapi.info.yml](https://git.drupalcode.org/project/drupal/-/raw/11.4.10/core/modules/jsonapi/jsonapi.info.yml) - [Drupal core 11.4.10: OffsetPage query class](https://git.drupalcode.org/project/drupal/-/raw/11.4.10/core/modules/jsonapi/src/Query/OffsetPage.php) - [Drupal core 11.4.10: Standard profile](https://git.drupalcode.org/project/drupal/-/raw/11.4.10/core/profiles/standard/standard.info.yml) ## Questions about JSON:API ### Is JSON:API enabled by default in Drupal 11? No. In Drupal 11.4.10 the Standard installation profile does not install the `jsonapi` module, so you enable it on the Extend page. It is a core module and has been since Drupal 8.7. Do not install the old contributed JSON:API project: its page says it is unsupported because of a security issue. ### Can JSON:API create and edit content, or only read it? Both are possible, but core ships in read-only mode: the default configuration sets `read_only: true`. To allow writing, open `/admin/config/services/jsonapi` and choose the option that accepts all create, read, update and delete operations. The form warns you to do this only if the site needs it. ### What is the difference between JSON:API and the core REST module? JSON:API works only on entities and always speaks JSON. The core REST module can also reach data that is not an entity and can use other formats, but drupal.org notes that it needs considerable setup. The module page describes JSON:API as a zero-configuration way to allow create, read, update and delete operations on a site's content. ### How many items does one JSON:API response contain? At most 50. In Drupal 11.4.10 the query code uses 50 as both the default and the maximum for `page[limit]` and lowers larger values to 50 without an error. Entity access checks can remove items, so a page may hold fewer. Follow the `next` link in the response to get the rest. ## Cite this definition "JSON:API." DXPR Drupal glossary, https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/json-api. Last updated October 26, 2026. Copy ## Related terms - [Headless Drupal](/hc/documentation/learn-drupal/drupal-glossary/headless-drupal) - [Entity](/hc/documentation/learn-drupal/drupal-glossary/entity) - [Bundle](/hc/documentation/learn-drupal/drupal-glossary/bundle) - [Entity type](/hc/documentation/learn-drupal/drupal-glossary/entity-type) - [Node](/hc/documentation/learn-drupal/drupal-glossary/node) - [URL](/hc/documentation/learn-drupal/drupal-glossary/url) [All Drupal terms from A to Z](/hc/documentation/learn-drupal/drupal-glossary)