SiberianCMS API Documentation

Introduction

Welcome to the SiberianCMS REST API documentation.

This doc contains reference materials to help you implementing the API into your system.

SiberianCMS API provides you with the ability to manage your users, as well as your applications.

You can find our PHP Library:

Siberian API php.

At a glance

The API is implemented with REST and is secured by an HTTP Basic Authentication or a Bearer Token.
The requests are made over HTTP POST and the responses are delivered in JSON.
For each request, you need to post all of your data together with your credentials previously created from your SiberianCMS's back-office.

Create your API User

Open your Siberian Backoffice, then go in Manage > Users > API
Create your user & select the API Accesses to grant him.
For the HTTP Basic Auth, simply uses your username & password.
For the Bearer Token, get the generated Token and send it to the API with the header below

// use this custom header, we do not use the regular Authorization HTTP header due to some restrictions.

Api-Auth-Bearer: Bearer YOURTOKEN

If your token is: 965327d7caa3d748bb70630b8f1ec64b7f0882ec
so your header will be

Api-Auth-Bearer: Bearer 965327d7caa3d748bb70630b8f1ec64b7f0882ec

Basic usage for the PHP library

Init the API with Basic Auth or Bearer token

<?php 
// Init with Basic Auth username/password
\Siberian\Api::init($domain, $username, $password);

// OR

// Init with Bearer token
\Siberian\Api::initWithBearer($domain, $bearerToken);

Create a new user

<?php 
$response = \Siberian\User::create($email, $password, $firstname, $lastname, $role_id);
if($response->isSuccess()) {
    $user_id = $response->getResponse("user_id");
    $token  = $response->getResponse("token");
} else {
    echo $response->getErrorMessage();
}

Create an application

   <?php 
$response = \Siberian\Application::create($name, $user_id);
if($response->isSuccess()) {
    $app_id = $response->getResponse("app_id");
    $app_url  = $response->getResponse("app_url");
} else {
    echo $response->getErrorMessage();
}

Other actions are documented here API Documentation

Run test (on you development instance)

Basic Auth

./run-test.sh siberianurl basic username password

Bearer token

./run-test.sh siberianurl bearer token

APIs

Here is the list of the available APIs:

Application

User

Backoffice

Push notifications

The global push API was removed in 5.0.0, see Push.

Local API access

!!! warning When enabled, every request made from the server itself skips the API authentication, no user, password or token is needed and all API privileges are granted. Leave it disabled unless you really need it.

The setting allow_local_api is read in the API base controller (Api_Controller_Default::init()). It is off by default (a missing setting counts as disabled), and only the exact value true enables it.

When it is enabled, a request skips the Basic and Bearer authentication and the ACL check if the client address equals the server address ($_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']), that is a call made from the same machine, typically a script or cron job running curl against the instance's own address.

To enable it, add this line to config.user.php (next to config.php, in the siberian folder; config.php loads it):

<?php
$_config['allow_local_api'] = true;

To disable it, remove the line or set it to false.

Security implications:

Anything running on the server, or able to send requests that reach the application from the server address (a reverse proxy on the same machine, a proxied request that appears to come from it, or another site hosted on the box), is fully trusted.
Behind a proxy, check what REMOTE_ADDR and SERVER_ADDR hold for your setup before enabling it.
Never enable it on shared hosting.