# How to create custom API Endpoints

**URL:** <https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202>\
**Category:** Support\
**Created:** [August 15, 2018, 3:54pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202 "2018-08-15T15:54:46Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![X72527](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/x72527/32/72_2.png) [@X72527](https://discourse.getcockpit.com/u/X72527)\
**Post date:** [August 15, 2018, 3:54pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/1 "2018-08-15T15:54:46Z")

</div>

Hi,  
I’m fairly new to PHP so I don’t know how to do this.  
Is there a way to create custom API Endpoints?  
I would like the user to be able to logout but im not sure how to call the available function.

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![serjoscha87](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/serjoscha87/32/151_2.png) [@serjoscha87](https://discourse.getcockpit.com/u/serjoscha87)\
**Post date:** [August 15, 2018, 4:10pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/2 "2018-08-15T16:10:52Z")

</div>

When you use the api, you just don’t log anyone out.

Your api requests pass an api token to the api endpoint in need of getting some data from cockpit. This api token won’t expire (as for now) and can **always** be used in order to fetch data without the need of authenticating a user at cockpit.

I guess you perhaps missunderstood the concept cockpit is based on.

The interface that you can log in to ([http://yourwebserver.com/cockpit](http://yourwebserver.com/cockpit)) is just for the content editor. This is just a admin / editor backend.

The **API** is for getting/fetching data that you may display on your webpage (or app or what ever).

A user that views your application (or webpage or what ever…) does not need to log in (and so he also does not need to log off) in order to make your application display data that you put in there as an admin/editor.

---

<div class="post-metadata">

**Author:** ![X72527](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/x72527/32/72_2.png) [@X72527](https://discourse.getcockpit.com/u/X72527)\
**Post date:** [August 15, 2018, 4:35pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/3 "2018-08-15T16:35:06Z")

</div>

Yes true but I want to use it for user management too, so that users can register an account and so on. Is that possible?  
Also is there a way to restrict certain Collections Entries for a particular user?  
I noticed there’s a access-list field type but the requesting user is always seeing all entries.

Thanks for your help

---

<div class="post-metadata">

**Author:** ![serjoscha87](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/serjoscha87/32/151_2.png) [@serjoscha87](https://discourse.getcockpit.com/u/serjoscha87)\
**Post date:** [August 15, 2018, 9:23pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/4 "2018-08-15T21:23:16Z")

</div>

> [@X72527](#):
>
> Yes true but I want to use it for user management too, so that users can register an account and so on. Is that possible?

I think it is possible but it won’t be that easy I guess.

For example this method can be used to check a user and password combination against the user DB of an cockpit installation:

```
public static function checkAuth($user, $pass){
    $url = self::$_COCKPIT_BACKEND_URL . '/auth/check';
    $fields = [
        'auth' => [
            'user' => $user,
            'password' => $pass,
        ]
    ];
    $data_string = json_encode($fields);
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Content-Type: application/json',
        'Content-Length: ' . strlen($data_string))
    );
    return json_decode(curl_exec($ch), true);
}

```

So if a user tries to log in with his credentials and this function returns a success. You could set a session variable in order to store the “logged in” state. In order to log the user out, you would then just delete the session. But this won’t come up with any solution in enabling users to register with your cockpit installation. I guess cockpit is not ment to be used this way buy indeed this should be able to do with some workarounds however.

> [@X72527](#):
>
> Also is there a way to restrict certain Collections Entries for a particular user?  
> I noticed there’s a access-list field type but the requesting user is always seeing all entries.

collection **entries**? I’m not completely sure about that; don’t think you can get this straight the easy way - but I guess you could do this by putting PHP code to the “read” ACL as I mentioned before within your other support request (where you attached the screenshot). But in general term collection entries are considered to be treated as one group of data - so without building workarounds you should not be able to restrict dedicated entries for one and the same user.

---

<div class="post-metadata">

**Author:** ![artur](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/artur/32/4_2.png) [@artur](https://discourse.getcockpit.com/u/artur)\
**Post date:** [August 15, 2018, 9:24pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/5 "2018-08-15T21:24:14Z")

</div>

In Cockpit you can create a custom api entry point pretty easy:

Create the following file `/config/api/custom.php`

we now do a custom query in that file:

```php
<?php

// very simple code here

$test = $this->param('test');

if (!$test) {
    return false;
}

return $test;

```

now you can query `/api/custom?token=xxx&test=foo,bar,baz`

if you want to have the api public (without token) then create the file in a subfolder named _public_: `/config/api/public/custom.php`

now you can query `/api/public/custom?test=foo,bar,baz`

---

<div class="post-metadata">

**Author:** ![pauloamgomes](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pauloamgomes/32/48_2.png) [@pauloamgomes](https://discourse.getcockpit.com/u/pauloamgomes)\
**Post date:** [August 16, 2018, 12:39pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/6 "2018-08-16T12:39:54Z")

</div>

Interesting, but the same couldn’t be achieved using a custom addon? I mean, if what is required is to provide further logic when accessing a custom endpoint may be better to encapsulate that in an addon than on PHP file inside the config.

---

<div class="post-metadata">

**Author:** ![serjoscha87](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/serjoscha87/32/151_2.png) [@serjoscha87](https://discourse.getcockpit.com/u/serjoscha87)\
**Post date:** [August 16, 2018, 12:41pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/7 "2018-08-16T12:41:31Z")

</div>

pauloamgomes - the grandmaster of cockpit addon creation 😂

---

<div class="post-metadata">

**Author:** ![artur](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/artur/32/4_2.png) [@artur](https://discourse.getcockpit.com/u/artur)\
**Post date:** [August 16, 2018, 1:14pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/8 "2018-08-16T13:14:55Z")

</div>

as always, it depends 😉 if you want something re-usable then I would also recommend to do an addon, but if it is something project specific, then custom api entry points are a solution to solve things or provide specific data quickly

---

<div class="post-metadata">

**Author:** ![pauloamgomes](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pauloamgomes/32/48_2.png) [@pauloamgomes](https://discourse.getcockpit.com/u/pauloamgomes)\
**Post date:** [August 16, 2018, 10:29pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/9 "2018-08-16T22:29:20Z")

</div>

sure, that makes sense and its really a quick way to solve the issue

---

<div class="post-metadata">

**Author:** ![eeight](https://avatars.discourse-cdn.com/v4/letter/e/41988e/32.png) [@eeight](https://discourse.getcockpit.com/u/eeight)\
**Post date:** [April 26, 2019, 7:15pm UTC](https://discourse.getcockpit.com/t/how-to-create-custom-api-endpoints/202/10 "2019-04-26T19:15:11Z")

</div>

@artur Would it be possible to add this information in the documentation:  
[https://getcockpit.com/documentation](https://getcockpit.com/documentation)

Maybe a new section called “Customization”?  
Can we pull request for adding this precious piece of information?