Security

JSON:API

JSON:API is a specification for building REST-style APIs that exchange JSON. A Drupal core module implements it, exposing non-internal entity types by default, with read-only mode on unless an administrator enables writes.

Deep dive

Learn Article

What Is Field-Level Authorization in an API?

Field-level authorization checks each property an API user can read or change. Without it, record access can expose prices, owners and order state.

beginner 5 min read

Back to glossary