JSON:API

A core module that serves Drupal content as JSON in the JSON:API format, shaped by filter, sort, include and paging parameters.

Aprender DrupalGlossário do Drupal Last updated

JSON:API is a core Drupal module that exposes entities as a web API following the JSON:API specification. Each bundle, such as the Article content type or a vocabulary, gets its own URL under /jsonapi that returns JSON. A separate website, mobile app or script can read that content, and with writing switched on, change it.

How it works in Drupal 11

The module is named jsonapi. It depends on the core Serialization and File modules. Its URLs follow one pattern: /jsonapi/{entity_type_id}/{bundle_id} for a collection and /jsonapi/{entity_type_id}/{bundle_id}/{uuid} for a single item. Articles live at /jsonapi/node/article. There is no URL at /jsonapi/node, because one path would have to serve several resource types. A request to /jsonapi itself returns an entry point that links to the available resources. Requests and responses use the media type application/vnd.api+json.

The query string does the work that you would otherwise do in code. filter limits a collection by field values, sort orders it, include embeds related entities in the same response, and page[limit] and page[offset] split large collections into pages.

JSON:API adds no access rules of its own. Drupal's entity access and field access are respected, and the validation constraints of the entity apply to write requests. By default the base path is /jsonapi; the security guide shows a jsonapi.base_path setting in services.yml to change it, and files this under security through obscurity that only makes automated attacks less effective.

Example

This request asks for the five newest published articles together with their authors:

GET /jsonapi/node/article?filter[status][value]=1&sort=-created&page[limit]=5&include=uid
        Accept: application/vnd.api+json

The response has a data array with the articles and an included array with the user entities that the include parameter asked for. When more articles exist, the response also carries a next link. The client follows that link instead of building page URLs on its own.

Status and add-ons

Checked on 26 October 2026: JSON:API has been part of core since Drupal 8.7, and the 8.7.0 announcement calls it a stable core feature. The Drupal 11.4.0 announcement of 1 July 2026 notes that Wim Leers stepped down as maintainer of the module. The contributed JSON:API Extras module changes what the API exposes: it can enable or disable resources, rename them, change their paths and disable fields. Its project page lists release 8.x-3.28 from 19 December 2025, an 8.x-3.29-beta1 from 16 October 2026, and compatibility with Drupal 11.

Common mistakes

  • Requesting a whole entity type. /jsonapi/node does not exist. Name the bundle, as in /jsonapi/node/article.
  • Expecting business logic. The drupal.org getting started guide says JSON:API does not support business logic, and names registering a new user account and resetting a password as examples. Plan custom code or the core REST module for those.
  • Exposing more than the front end needs. The security guide says JSON:API has a bigger API surface out of the box, because every entity type that is not internal is exposed. Turn off resource types or fields you do not use, in a custom module or with JSON:API Extras.
  • Fetching related items one by one. A client that loads every author with a second request wastes round trips. The include parameter returns them together, and a user shared by several items appears only once.

For marketing and content teams

JSON:API is the reason a headless Drupal site can show content you edit in Drupal's own forms. What you save as an entity is served as it is stored, and the same access rules apply as in the editing interface. When a developer proposes a new app or front end, ask which content types and fields it will read, and whether it will only read or also write. That decides what a site builder must expose and what stays hidden.

Sources

Questions about JSON:API

No. In Drupal 11.4.10 the Standard installation profile does not install the jsonapi module, so you enable it on the Extend page. It is a core module and has been since Drupal 8.7. Do not install the old contributed JSON:API project: its page says it is unsupported because of a security issue.

Both are possible, but core ships in read-only mode: the default configuration sets read_only: true. To allow writing, open /admin/config/services/jsonapi and choose the option that accepts all create, read, update and delete operations. The form warns you to do this only if the site needs it.

JSON:API works only on entities and always speaks JSON. The core REST module can also reach data that is not an entity and can use other formats, but drupal.org notes that it needs considerable setup. The module page describes JSON:API as a zero-configuration way to allow create, read, update and delete operations on a site's content.

At most 50. In Drupal 11.4.10 the query code uses 50 as both the default and the maximum for page[limit] and lowers larger values to 50 without an error. Entity access checks can remove items, so a page may hold fewer. Follow the next link in the response to get the rest.

Cite this definition

"JSON:API." DXPR Drupal glossary, https://dxpr.com/hc/documentation/learn-drupal/drupal-glossary/json-api. Last updated October 26, 2026.

Related terms

All Drupal terms from A to Z