XML-RPC

Remote procedure call protocol that Drupal 8 moved out of core into a contributed module; JSON:API and REST are the web services core ships.

Learn DrupalDrupal glossary
Edited by Founder and CEO, DXPR Last updated

XML-RPC is a remote procedure call protocol: a client sends a method name and arguments to an endpoint on a server and gets the result back, encoded in XML. Drupal had an XML-RPC server and client in core up to Drupal 7. Core stopped shipping them in Drupal 8, and Drupal 11 core has no XML-RPC module.

Status today

The Drupal.org overview says the subsystem was in core from Drupal 4.0.x to 7.x and that Drupal 8 moved it to a contributed module. The change record, dated 13 June 2012, adds that on Drupal 8 the contributed module has to be enabled for XML-RPC communication to work, and that once it is enabled the callback is the same as in Drupal 7.

Core issue 1285726 removed it. Its reasoning, as the thread records it: nothing left in core made use of the XML-RPC library, and with a REST web service built in there was no need for a second web service interface. The commit went into 8.0.x on 31 July 2014.

The code lives on in the contributed XML-RPC project. On 2026-10-26 its page showed the status "Minimally maintained", support for Drupal 10 and 11, and no stable release; the latest was 8.x-1.0-rc2 from 9 April 2024.

What replaced it

The core help topic on web services names two core modules for exposing a site to other applications. The JSON:API module offers a JSON:API-compliant interface to entities, and its documentation calls it a zero-configuration way to allow RESTful create, read, update and delete operations on a site's content. The RESTful Web Services module exposes entities and other resources through REST. Both ship with core. See services API for how Drupal's own internal services differ from web services.

Example

An old integration still calls your site's XML-RPC endpoint, and you are moving to Drupal 11. You have two options:

  1. Keep the integration alive. Require and enable the contributed module (composer require 'drupal/xmlrpc:^1.0@RC', the command its release page gives, then enable it on the Extend page). Per the change record, the callback stays the same as in Drupal 7.
  2. Replace it. Enable JSON:API or RESTful Web Services and rewrite the client to call them.

Common mistakes

  • Looking for XML-RPC in core. A tutorial written for Drupal 7 assumes it is there. In Drupal 8 and later you must add the contributed module.
  • Starting a new integration on it. It would tie the site to a contributed module that core dropped in Drupal 8. New work should use a core web service module.
  • Leaving it on without a client. If no tool calls the endpoint any more, uninstall the module and remove it from the codebase.

For marketing and content teams

If an upgrade audit mentions XML-RPC, some external tool still talks to the site through it. Ask your developer which one, and whether it can move to JSON:API or REST before the upgrade date.

Sources

Questions about XML-RPC

No. It was part of core from Drupal 4.0.x to 7.x and moved to a contributed module in Drupal 8. The Drupal 11.4.10 codebase has no XML-RPC module among its core modules.

The core JSON:API module and the core RESTful Web Services module. The core help topic on web services lists both as core modules that expose entities to other applications.

Yes, with the contributed XML-RPC project, which lists Drupal 10 and 11 support. When checked on 2026-10-26 it was minimally maintained and had no stable release, only 8.x-1.0-rc2 from 9 April 2024.

Related terms

All Drupal terms from A to Z