API:Restricting API usage

---

This page is part of the MediaWiki action API documentation.

MediaWiki APIsAPI:Main page

• Web APIs showcaseAPI:Web APIs hub
• REST content API

MediaWiki action API

• Introduction and quick startAPI:Main page
• FAQAPI:FAQ
  • Etiquette and usage limitsAPI:Etiquette
• TutorialAPI:Tutorial
• FormatsAPI:Data formats
• Error reportingAPI:Errors and warnings
• Restricting usageAPI:Restricting API usage
• Cross-site requestsAPI:Cross-site requests
• Authentication
  • LoginAPI:Login
  • LogoutAPI:Logout
  • Account creationAPI:Account creation
• QueriesAPI:Query
  • Meta informationAPI:Meta
  • PropertiesAPI:Properties
  • ListsAPI:Lists
• Searching (by title, content, coordinates...)API:Search and discovery
• Parsing wikitext and expanding templatesAPI:Parsing wikitext
• Purging pages' cachesAPI:Purge
• Parameter informationAPI:Parameter information
• Changing wiki contentAPI:Changing wiki content
  • Create and edit pagesAPI:Edit
  • Move pagesAPI:Move
  • Merge pagesAPI:Mergehistory
  • RollbackAPI:Rollback
  • Delete pagesAPI:Delete
  • Restore deleted revisionsAPI:Undelete
  • (Un)protect pagesAPI:Protect
  • (Un)block usersAPI:Block
  • (Un)watch pagesAPI:Watch
  • Mark revisions of watched pages as visitedAPI:SetNotificationTimestamp
  • Send emailAPI:Email
  • Patrol changesAPI:Patrol
  • Import pagesAPI:Import
  • Change user group membershipAPI:User group membership
  • Upload filesAPI:Upload
  • User optionsAPI:Options
  • TokensAPI:Tokens
  • Page languageAPI:PageLanguage
• Watchlist feedAPI:Watchlist feed
• WikidataWikibase/API
• ExtensionsAPI:Extensions
• Using the API in MediaWiki and extensionsAPI:Calling internally
• MiscellaneousAPI:Other services
• ImplementationAPI:Implementation Strategy
  • LocalisationAPI:Localisation
• Client codeAPI:Client code
• AssertingAPI:Assert

There are several ways to restrict usage of (certain parts of) the API to certain groups of users, or to disable it altogether. Some of these require changing group permissions.

Disabling the entire API

You can disable the API as a whole by setting $wgEnableAPIManual:$wgEnableAPI = false; in LocalSettings.phpManual:LocalSettings.php. The API is enabled by default.

Disabling the write API

You can disable all write modules by setting $wgEnableWriteAPIManual:$wgEnableWriteAPI = false; in LocalSettings.php. The write API is enabled by default as of MediaWiki 1.14, and disabled by default in older versions.

Restricting access to the write API

You can deny certain groups the right to use the write API by denying them the writeapi right. By default, all groups have the writeapi right. However, both the writeapi right and $wgEnableWriteAPI = true; are required in order to use the write API.

Disabling modules

You can disable individual modules for all users by adding a line to LocalSettings.php. Exactly what to add depends on the type of module you want to disable:

• For action= modules, use $wgAPIModulesManual:$wgAPIModules['modulename'] = 'ApiDisabled';
• For prop= modules, use $wgAPIPropModulesManual:$wgAPIPropModules['modulename'] = 'ApiQueryDisabled';
• For list= modules, use $wgAPIListModulesManual:$wgAPIListModules['modulename'] = 'ApiQueryDisabled';
• For meta= modules, use $wgAPIMetaModulesManual:$wgAPIMetaModules['modulename'] = 'ApiQueryDisabled';

Example

To disable anyone who isn't a sysop from using action=edit:

if ( !in_array( 'sysop', $wgUser->getGroups() ) ) {
	$wgAPIModules['edit'] = 'ApiDisabled';
}