Drupal JSON:API
Drupal's built-in JSON:API module exposes all content entities as a standards-compliant REST API for headless/decoupled architecture.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Access control relies on Drupal's permission system. Enable HTTPS and use OAuth2 — never basic auth in production.
⚡ Reliability
Best When
Best for existing Drupal sites adding headless frontend or automating content workflows via standard JSON:API.
Avoid When
Avoid when building a new CMS from scratch — consider Contentful, Sanity, or Strapi for greenfield.
Use Cases
- • Build headless Drupal frontends by fetching nodes, taxonomy, and media via JSON:API endpoints
- • Automate content management workflows by creating/updating nodes programmatically via PATCH/POST
- • Migrate content between Drupal instances using JSON:API for bulk content export and import
- • Build content-driven AI agents that query Drupal content by taxonomy, date, or field filters
- • Integrate Drupal content into multi-source aggregation pipelines using standardized JSON:API responses
Not For
- • Non-Drupal CMS platforms — this evaluation is specific to Drupal's JSON:API module
- • Simple read-only content delivery where a CDN-cached REST API is sufficient
- • Teams expecting a traditional flat REST API — JSON:API has a specific envelope and relationship structure
Interface
Authentication
Simple OAuth2 module recommended for token auth. Basic auth available but discouraged in production. Anonymous read access configurable per bundle.
Pricing
GPL licensed. JSON:API module included in Drupal core since 8.7.
Agent Metadata
Known Gotchas
- ⚠ All responses use JSON:API envelope with data.attributes — agents must unwrap, not expect flat field access
- ⚠ Relationships (taxonomy terms, media) are separate requests unless include parameter is used — causes N+1 without include
- ⚠ Anonymous write access is disabled by default — 403 errors on POST/PATCH without proper role and OAuth token
- ⚠ Drupal's internal entity IDs differ from UUID — always use UUID in JSON:API paths, never numeric drupal_internal__id
- ⚠ Filters use complex ?filter[field][operator]=value syntax — complex queries across relationships require nested filter syntax
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Drupal JSON:API.
Scores are editorial opinions as of 2026-03-06.