Jump to content

New Module: AppApi


Recommended Posts

Hello friends!
I have another module for you, which will make your daily work as a Processwire developer easier.


This module helps you to create api-endpoints, to which an app or an external service can connect to.


  • Simple routing definition
  • Authentication - Three different authentication-mechanisms are ready to use.
  • Access-management via UI
  • Multiple different applications with unique access-rights and authentication-mechanisms can be defined

The documentation has become quite extensive, so have a look at the Github repository for details:

A special thanks goes to Thomas Aull , whose module RestApi was the starting point to this project. This module is not meant to replace this module because it does a great job. But if you want to connect and manage multiple apps or need other authentication methods, this module might help you.

I am already very curious about your feedback and would be glad if the module helps you a little bit.

  • Like 26
  • Thanks 3
Link to comment
Share on other sites

  • 2 weeks later...

Hello everyone,

I'm having a problem when trying to make a request to the API using HTTPs.
Whenever I use HTTPS to make the request I get an object not found error.
When using HTTP I don't have such an error. However I require HTTPS to make authentication calls from outside processwire with double JWT token.
I use XAMPP to set up my localhost. I did redirect my localhost to use a domain name and also had to use a different port (other than default) for my mysql port since I already had something listening to the default port.
Accessing my processwire application from localhost works with https but it is not secure. 

Any of you know what i'm doing wrong?

Kind regards,


2020-08-06 13_41_11-Window.png

2020-08-06 13_40_15-Window.png

Link to comment
Share on other sites

Hi @Krevolution,

glad to hear that you could solve the problem by yourself.

I'm the author of the AppApi-module your using. If you encounter more problems or questions regarding AppApi, feel free to mention me via @Sebi. That makes sure, that I get a notification about it.

Anyway, I am pleased that you use the module!

Link to comment
Share on other sites

I really like to use Insomnia testing api-calls. It's a stand-alone tool for Mac, Windows and Linux. And the free plan suits perfectly for all my needs - the paid functions are primary focuses on collaboration features for teams.

  • Like 3
Link to comment
Share on other sites

Yeah this is pretty awesome! Since I'm struggeling with carving out time for the RestApi module over the last year (sorry again for not giving your PR much love @Sebi) I'm pretty happy someone is pushing things forward :) Actually I'm thinking maybe this module should be the official continuation of my RestApi Module. For me it looks like it is more advanced and as far as I can tell by creating a single endpoint the way things are used would be quite similar. What do you think?

I'm gonna check it out myself now :)

  • Like 1
Link to comment
Share on other sites

I already have the first request: I was planning to, instead using a hook to intercept the request to play out the api it would be better to (again) use a page in the regular ProcessWire tree for the following reasons:

  • Multi Language does not work with the current solution
  • Caching with ProCache does not work with the current solution
  • It is harder for users of the API module to use Subdirectories

Also another request by a user was to move the API routes in `/templates` so it would be included in exports with the site profile export module.

  • Like 1
Link to comment
Share on other sites

Two more things:

  • Can you enable Issues in your respository on github?
  • I'm getting an error in this line: https://github.com/Sebiworld/AppApi/blob/master/classes/Router.php#L275
    Changing it to
    if ($last_error && $last_error['type'] === E_ERROR) {

    fixes it. (This was already suggested by someone some time ago on the RestApi module).
    I was providing a PR, but since AppApi is a fork of RestApi, when I try to fork it, it just goes back to my module 😅

  • Like 1
Link to comment
Share on other sites

@Sebi i'm trying to delete a page using the api like so:

public static function deletePage($data){
        if(property_exists($data, 'clients')) {
            foreach($data->clients as $client) {
                if ($client->changeType == 0) {
                    if(property_exists($client, 'id')) {
                        $p = wire('pages')->get($client->id);
'package' => [
	['OPTIONS', 'update-package', ['POST']],
	['POST', 'update-package', Package::class, 'updatePackage', ["auth" => false]],
	['DELETE', 'delete-page', Package::class, 'deletePage', ["auth" => false]]

for some reason I get an error ->
"Trying to get property 'id' of non-object"

After some research I found that the error is located in the isDeletable check from pagesEditor inside the wire.


more specifically the last else if check. When I bypass this whole block it works to delete so the id is fine.

Any suggestions?

Kind regards.

Link to comment
Share on other sites

Hi @thomasaull,

nice to hear that you like what I did to your module 😅 I would really appreciate it if we could work together on the next developments. For my projects a good and flexible Api connection is very important. Therefore I hope that we can improve the module even more.

So, let me answer your comments one after another:

if ($last_error && $last_error['type'] === E_ERROR) {

Consider that as fixed. I just pushed version 1.0.3 with a few documentation-fixes and this bugfix. Thank you for this hint!

I activated Github-Issues for the repository as well. I think, issues and/or pull requests on Github will be a better way to work on new features and bugfixes, since this forum-post would become long and more and more confusing. I additionally contacted Github whether it is possible to remove the fork-connection to your RestApi-repository.

Link to comment
Share on other sites


On 8/7/2020 at 11:52 AM, thomasaull said:

I already have the first request: I was planning to, instead using a hook to intercept the request to play out the api it would be better to (again) use a page in the regular ProcessWire tree for the following reasons:

  • Multi Language does not work with the current solution
  • Caching with ProCache does not work with the current solution
  • It is harder for users of the API module to use Subdirectories

I'm not sure, if I understand you right: Do you want to trigger an api-call on a different hook? Do you have an example, maybe a code-snippet, how you would do it? What I like on the current way is, that you do not need to create a page or a file in the templates-directory. So you can have a complex existing site, install the module and the module would work without the need to change something in the pagetree. But that can be only a matter of opinion, I think that other ways would also have advantages.

I'm currently trying out a multi-language site and will give you an update if I could find a practicable way to implement this. My experiences with caching are, to be honest, very limited so far. So if anybody knows about it and could suggest improvements, that would be great!

On 8/7/2020 at 11:52 AM, thomasaull said:

Also another request by a user was to move the API routes in `/templates` so it would be included in exports with the site profile export module.

I think I can make the path to api-routes easily configurable, so it can be moved to /templates if the user needs it there.

On 8/7/2020 at 11:59 AM, thomasaull said:

Another thing which would make usage of this module easier for users of the RestApi module would be to have an option to not have to use ApiKeys to access the API

I think that could be solved by some kind of default-application, that is called if no api-key is found in a request. It's a little complicated, because the module needs the api-key to choose the corresponding application.

Apikeys bring a bunch of benefits, which a default-application without an apikey cannot have. We would not be able to block old apikeys. We make it easier for bots to scrape our page. And it could be confusing, when we just forget to add the apikey-header and will be sent to the default-application without an error. 

I would consider that as a future improvement, but I think it needs some more thought before implementing it. 

So, thanks again @thomasaull for your comments. Can you please make issues on Github out of this?

Link to comment
Share on other sites

On 8/7/2020 at 5:42 PM, Krevolution said:

After some research I found that the error is located in the isDeletable check from pagesEditor inside the wire.


more specifically the last else if check. When I bypass this whole block it works to delete so the id is fine.

Any suggestions?

Kind regards.

I tried it out and could reproduce the error in my configuration as well. The problem here is not your $page that you want to delete. The problem is, that $this->wire('page') is null, because you requested no special page which processwire can use as its current page. I would consider that as a processwire-bug, it could easily prevented by adding a check if $this->wire('page') contains a page. What do you think? Maybe @ryan can add something to it?

On 8/7/2020 at 5:42 PM, Krevolution said:

public static function deletePage($data){ if(property_exists($data, 'clients')) { foreach($data->clients as $client) { if ($client->changeType == 0) { if(property_exists($client, 'id')) { $p = wire('pages')->get($client->id); wire('pages')->trash($p); } } } } }

Nevertheless, I would like to suggest something about your code example. Please be aware, that you must make sure, that only valid page-ids will be accepted and only valid client-pages will be deleted. If I send a request with an id like 0, I could try to delete the root-page if I want to. Please check everything, that comes from an api-request and sanitize these values. This is how I would do it:

public static function deletePage($data){
	if (!property_exists($data, 'clients')) { throw new \Exception('No clients found', 400); }
	foreach($data->clients as $client) {
		if ($client->changeType == 0) {
			if(!property_exists($client, 'id')) { continue; }

			$p = wire('pages')->get(wire('sanitizer')->int($client->id));
			if(!$p->id || $p->template->name !== 'client') { continue; }



Link to comment
Share on other sites

On 8/7/2020 at 11:52 AM, thomasaull said:
  • Caching with ProCache does not work with the current solution

For what it is worth, I use this intermediate solution to use ProCache in combination with the RestAPI module:  https://processwire.com/talk/topic/20006-module-restapi/?do=findComment&comment=186881.

Which gives me:
1. site.url/rest-api => live data
2. site.url/api => served by ProCache

Of course this would only be useful for (static) pages that don't require any authentication or whatsoever. 


  • Like 1
Link to comment
Share on other sites

Recently i have released the new version 1.0.4 of AppApi.

In this version I use ProcessPageView::pageNotFound instead of the previous used ProcessPageView::execute hook. This hook is triggered later in ProcessWire's boot process, which should allow features like multi-language fields and other modules to initialize before the api tries to access their values. Let me know, if it worked for you!

Besides that you can now configure the path to the Routes.php file, that is located under site/api/Routes.php per default. If you need to have it somewhere else, you can set any location (relative to ProcessWire's root directory) in the module's settings.

Thanks to @thomasaull and @spoetnik for supporting me with issues and comments in the AppApi Github repository!  

  • Like 4
Link to comment
Share on other sites

  • 3 months later...

Sorry for all the questions ... Its not clear to me currently how version numbers or api keys or users are related and can be used to auth against a certain route... is that something we have to build into the api call to test the signed in user and their restrictions? be cool if this was tired into the auth stage/routes as you have all the parts there available but not tied together for some reason...?

Link to comment
Share on other sites

@benbyf I'm going to try to give you some answers:

  • What do you mean by „the log wasn't created for this module"? Can you clarify your question a bit?
  • You can disable auth for certain routes by setting `"auth" => false` in the route options. This is not explicitly documented at the moment, but here is an example where it's set to true: https://github.com/Sebiworld/AppApi#example-listing-users
  • Version numbers are a way to make breaking changes to your API and check for that in the client (e.g. if the client requests API v1 but the newer v2 should be used you can return a warning which the client displays to the user (e.g. to update the software, refresh the website, …)
  • API Keys are way to guard your API to only be accessed by your apps. This is not possible in the browser, since the code would be readable but certainly for complied Apps
  • If you want to restrict API access of certain user roles (`superadmin` is allowed more than `editor`) you'll have to add this logic by yourself in the route methods (it's basically ProcessWire API from there)
Link to comment
Share on other sites

Thanks! @thomasaull

  1. I mean on the settings page the is a link to a log, which when clicked takes you to the logs overview page with an error saying the log you were trying to access doesnt exist.
  2. disabling auth doesnt create an open endpoint as you still need an apikey to access anything without an error
  3. sounds good but how do you implement this as there is nothing in the docs?
  4. ?
  5. cool beans, but my comment still stands 🙂
Link to comment
Share on other sites


  1. I see… I guess you'll have to wait for an answer from @Sebi for this one
  2. That's right actually, I just checked the source, apparently there is no way to access the API without an API Key. The `auth` option only says, if a guest is allowed to access the endpoint. What's holding you back to use an API Key?
  3. I think the way to do it is to generate a new API Key for the new version. As soon as the client for the new version is released you can delete the old version. The clients which are still on the old version will get an Error like "API Key not valid" or similar which you can use in your client to guide the user to do whatever you want from there 😉
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By LuisM
      Symprowire is a PHP MVC Framework based and built on Symfony using ProcessWire 3.x as DBAL and Service-Provider
      It acts as a Drop-In Replacement Module to handle the Request/Response outside the ProcessWire Admin. Even tough Symfony or any other mature MVC Framework could be intimidating at first, Symprowire tries to abstract Configuration and Symfony Internals away as much as possible to give you a quick start and lift the heavy work for you.
      The main Goal is to give an easy path to follow an MVC Approach during development with ProcessWire and open up the available eco-system.
      You can find the GitHub Repo and more Information here: https://github.com/Luis85/symprowire
      The Symprowire Wiki https://github.com/Luis85/symprowire/wiki How to create a simple Blog with Symprowire https://github.com/Luis85/symprowire/wiki/Symprowire-Blog-Tutorial Last Update
      16.07.2021 // RC 1 v0.6.0 centralized ProcessWire access trough out the Application by wrapping to a Service https://github.com/Luis85/symprowire/releases/tag/v0.6.0-rc-1 Requirements
      PHP ^7.4 Fresh ProcessWire ^3.0.181 with a Blank Profile Composer 2 (v1 should work, not recommended) The usual Symfony Requirements Features
      Twig Dependency Injection Monolog for Symprowire Support for .env YAML Configuration Symfony Console and Console Commands Symfony Webprofiler Full ProcessWire access inside your Controller and Services Webpack Encore support Caveats
      Symfony is no small Framework and will come with a price in terms of Memory Usage and added Overhead. To give you a taste I installed Tracy Debugger alongside to compare ProcessWire profiling with the included Symfony Webprofiler

      So in a fresh install Symprowire would atleast add another 2MB of Memory usage and around 40ms in response time, should be less in production due to the added overhead of the Webprofiler in dev env
    • By FireWire
      Hello community!

      I want to share a new module I've been working on that I think could be a big boost for multi-language ProcessWire sites.

      Some background, I was looking for a way for our company website to be efficiently translated as working with human translators was pretty laborious and a lack of updating content created a divergence between languages. I, and several other devs here, have talked about translation integrations and have recognized the power that DeepL has. DeepL is an AI deep learning powered service that delivers translation quality beyond any automated service available. After access to the API was opened up to the US, I built Fluency, a DeepL translation integration for ProcessWire.
      Fluency brings automated translation to every multi-language field in the admin, and also provides a translation tool allowing the user to translate their text to any language without it being inside a template's field. With Fluency you can:
      Translate any plain textarea or text input Translate any CKEditor content (yes, with markup) Translate page names for fully localized URLs on every page Translate your in-template translation function wrapped strings Translate modules Fluency is free, and now so is DeepL
      Since this module was first built DeepL has introduced free Developer accounts that allow anyone to start using Fluency at zero cost and beginning with the version 0.3.0 release Fluency now supports free DeepL accounts. As of June 2021 DeepL supports translation to 26 languages and continues to offer more!
      Installation and usage is completely plug and play. Whether you're building a new multi-language site, need to update a site to multi-language, or simply want to stop manually translating a site and make any language a one-click deal, it could not be easier to do it. Fluency works by having you match the languages configured in ProcessWIre to DeepL's. You can have your site translating to any or all of the languages DeepL translates to in minutes (quite literally).
      Let's break out the screenshots...
      When the default language tab is shown, a message is displayed to let users know that translation is available. Clicking on each tab shows a link that says "Translate from English". Clicking it shows an animated overlay with the word "Translating..." cycling through each language and a light gradient shift. Have a CKEditor field? All good. Fluency will translated it and use DeepL's ability to translate text within HTML tags. CKEditor fields can be translated as easily and accurately as text/textarea fields.

      Repeaters and AJAX created fields also have translation enabled thanks to a JavaScript MutationObserver that searches for multi-language fields and adds translation as they're inserted into the DOM. If there's a multi-language field on the page, it will have translation added.

      Same goes for image description fields. Multi-language SEO friendly images are good to go.

      Creating a new page from one of your templates? Translate your title, and also translate your page name for native language URLs. (Not available for Russian, Chinese, or Japanese languages due to URL limitations). These can be changed in the "Settings" tab for any page as well so whether you're translating new pages or existing pages, you control the URLs everywhere.

      Language configuration pages are no different. Translate the names of your languages and search for both Site Translation Files (including all of your modules)

      Translate all of the static text in your templates as well. Notice that the placeholders are retained. DeepL is pretty good at recognizing and keeping non-translatable strings like that. If it is changed, it's easy to fix manually.

      Fluency adds a "Translate" item to the CMS header. When clicked this opens up a modal with a full translation tool that lets the user translate any language to any language. No need to leave the admin if you need to translate content from a secondary language back to the default ProcessWire language. There is also a button to get the current API usage statistics. DeepL account owners can set billing limitations via character count to control costs. This may help larger sites or sites being retrofitted keep an eye on their usage. Fluency can be used by users having roles given the fluency-translate permission.

      It couldn't be easier to add Fluency to your new or existing website. Simply add your API key and you're shown what languages are currently available for translation from/to as provided by DeepL. This list and all configuration options are taken live from the API so when DeepL releases new languages you can add them to your site without any work. No module updates, just an easy configuration. Just match the language you configured in ProcessWire to the DeepL language you want it to be associated with and you're done. Fluency also allows you to create a list of words/phrases that will not be translated which can prevent items such as brands and company names from being translated when they shouldn't

      No "translate page" - Translating multiple fields can be done by clicking multiple translation links on multiple fields at once but engineering a "one click page translate" is not feasible from a user experience standpoint. The time it takes to translate one field can be a second or two, but cumulatively that may take much longer (CKEditor fields are slower than plain text fields). There may be a workaround in the future but it isn't currently on the roadmap. No "translate site" - Same thing goes for translating an entire website at once. It would be great, but it would be a very intense process and take a very (very) long time. There may be a workaround in the future but it isn't on the roadmap. No current support for Inline CKEditor fields - Handling for CKEditor on-demand hasn't been implemented yet, this is planned for a future release though and can be done. I just forgot about it because I've never really used that feature personally.. Alpha release - This module is in alpha. Releases should be stable and usable, but there may be edge case issues. Test the module thoroughly and please report any bugs via a Github issue on the repository or respond here. Please note that the browser plugin for Grammarly conflicts with Fluency (as it does with many web applications). To address this issue it is recommended that you disable Grammarly when using Fluency, or open the admin to edit pages in a private window where Grammarly may not be loaded. This is an issue that may not have a resolution as creating a workaround may not be possible. If you have insight as to how this may be solved please visit the Github page and file a bugfix ticket.
      ProcessWire  3.0+ UIKit Admin Theme That's Fluency in a nutshell. A core effort in this module is to create it so that there is nothing DeepL related hard-coded in that would require updating it when DeepL offers new languages. I would like this to be a future-friendly module that doesn't require developer work to keep it up-to-date.
      The Module Is Free
      This is my first real module and I want to give it back to the community as thanks. This is the best CMS I've worked with (thank you Ryan & contributors) and a great community (thank you dear reader).
      DeepL Developer Accounts
      In addition to paid Pro Developer accounts, DeepL now offers no-cost free accounts. Now all ProcessWire developers and users can use Fluency at no cost.
      Learn more about free and paid accounts by visiting the DeepL website. Sign up for a Developer account, get an API key, and start using Fluency today.
      Download & Feedback
      Download the latest version here
      Github repository:
      File issues and feature requests here (your feedback and testing is greatly appreciated):
      Thank you! ¡Gracias! Ich danke Ihnen! Merci! Obrigado! Grazie! Dank u wel! Dziękuję! Спасибо! ありがとうございます! 谢谢你!

    • By tcnet
      PageViewStatistic for ProcessWire is a module to log page visits of the CMS. The records including some basic information like IP-address, browser, operating system, requested page and originate page. Please note that this module doesn't claim to be the best or most accurate.
      One of the biggest advantage is that this module doesn't require any external service like Google Analytics or similar. You don't have to modify your templates either. There is also no Javascript or image required.
      There is only one disadvantage. This module doesn't record visits if the browser loads the page from its browser cache. To prevent the browser from loading the page from its cache, add the following meta tags to the header of your page:
      <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" /> <meta http-equiv="Pragma" content="no-cache" /> <meta http-equiv="Expires" content="0" /> How to use
      The records can be accessed via the Setup-menu of the CMS backend. The first dropdown control changes the view mode.

      Detailed records
      View mode "Detailed records" shows all visits of the selected day individually with IP-address, browser, operating system, requested page and originate page. Click the update button to see new added records.

      Cached visitor records
      View modes other than "Detailed records" are cached visitor counts which will be collected on a daily basis from the detailed records. This procedure ensures a faster display even with a large number of data records. Another advantage is that the detailed records can be deleted while the cache remains. The cache can be updated manually or automatically in a specified time period. Multiple visits from the same IP address on the same day are counted as a single visitor.

      Upgrade from older versions
      Cached visitor counts is new in version 1.0.8. If you just upgraded from an older version you might expire a delay or even an error 500 if you display cached visitor counts. The reason for this is that the cache has to be created from the records. This can take longer if your database contains many records. Sometimes it might hit the maximally execution time. Don't worry about that and keep reloading the page until the cache is completely created.
      Special Feature
      PageViewStatistic for ProcessWire can record the time a visitor viewed the page. This feature is deactivated by default. To activate open the module configuration page and activate "Record view time". If activated you will find a new column "S." in the records which means the time of view in seconds. With every page request, a Javascript code is inserted directly after the <body> tag. Every time the visitor switches to another tab or closes the tab, this script reports the number of seconds the tab was visible. The initial page request is recorded only as a hyphen (-).

      New in version 1.1.0
      A new feature comes with version 1.1.0 which offers to record user names of loggedin visitors. Just activate "Record user names" and "Record loggedin user" in the module settings.
      You can access the module settings by clicking the Configuration button at the bottom of the records page. The settings page is also available in the menu: Modules->Configure->ProcessPageViewStat.
      This module uses the IP2Location database from: http://www.ip2location.com. This database is required to obtain the country from the IP address. IP2Location updates this database at the begin of every month. The settings of ProcessPageViewStat offers the ability to automatically download the database monthly. Please note, that automatically download will not work if your webspace doesn't allow allow_url_fopen.
      This module uses DragScroll. A JavaScript available from: http://github.com/asvd/dragscroll. Dragscroll adds the ability in view mode "Day" to drag the records horizontally with the mouse pointer.
      This module uses the PHP class parseUserAgentStringClass available from: http://www.toms-world.org/blog/parseuseragentstring/. This class is required to filter out the browser type and operating system from the server request.
    • By clsource
      Inertia Adapter ProcessWire Module
      Hello! Long time no see.
      I created this module so you can use Inertia.js (https://inertiajs.com/) with ProcessWire.
      Inertia allows you to create fully client-side rendered, single-page apps, without much of the complexity that comes with modern SPAs. It does this by leveraging existing server-side frameworks.
      Inertia isn’t a framework, nor is it a replacement to your existing server-side or client-side frameworks. Rather, it’s designed to work with them. Think of Inertia as glue that connects the two. Inertia comes with three official client-side adapters (React, Vue, and Svelte).
      This is an adapter for ProcessWire. Inertia replaces PHP views altogether by returning JavaScript components from controller actions. Those components can be built with your frontend framework of choice.
      - https://github.com/joyofpw/inertia
      - https://github.com/joyofpw/inertia-svelte-mix-pw
      - https://inertiajs.com/

    • By sms77io
      Hi all,
      we made a small module for sending SMS via Sms77.io. It supports sending to one and multiple users.
      You can download it from GitHub and follow the instructions on how to install it - it is quite easy. An API key is required for sending, get yours for free @ Sms77 and receive 0,50 €.
      Hope this helps somebody and we are open for improvement suggestions!
      Best regards
  • Create New...