PHPackages                             maikschneider/tca-api - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. maikschneider/tca-api

ActiveTypo3-cms-extension[HTTP & Networking](/categories/http)

maikschneider/tca-api
=====================

This package provides an REST API based on the TYPO3 TCA — exposes database tables as Hydra JSON-LD resources.

0.4.0(1mo ago)8539—5.6%[25 issues](https://github.com/maikschneider/tca-api/issues)[2 PRs](https://github.com/maikschneider/tca-api/pulls)GPL-2.0-or-laterPHPPHP ^8.2CI passing

Since May 26Pushed 2w agoCompare

[ Source](https://github.com/maikschneider/tca-api)[ Packagist](https://packagist.org/packages/maikschneider/tca-api)[ Docs](https://extensions.typo3.org/extension/tca_api)[ RSS](/packages/maikschneider-tca-api/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (5)Dependencies (33)Versions (18)Used By (0)

`TCA_API` — REST API for TYPO3
==============================

[](#tca_api--rest-api-for-typo3)

[![Extension icon](Resources/Public/Icons/Extension.svg)](Resources/Public/Icons/Extension.svg)

[![License](https://camo.githubusercontent.com/26f8b6541ea045cc1dbc2267208158b5a7ebbf5cf437c4b486d80fee9386f77e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d47504c2d2d322e302d2d6f722d2d6c617465722d626c75652e737667)](https://www.gnu.org/licenses/gpl-2.0.html)[![TYPO3](https://camo.githubusercontent.com/2a9e26a089f5d6ad678941800c95e6380c9bc3aeaa261f81c62612119c2dcc3d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5459504f332d31332e3425323025374325323031342d6f72616e67652e737667)](https://typo3.org/)[![PHP](https://camo.githubusercontent.com/eebfeb80482c8b896dff0a49d47a9960936961bba1a8aad1d948a028a7c7d413/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253545382e322d3737374242342e737667)](https://php.net/)[![codecov](https://camo.githubusercontent.com/c3cfe2224a258dc0b4b68408351cbb09603c334394bec1428778aeafcaa8f841/68747470733a2f2f636f6465636f762e696f2f67682f6d61696b7363686e65696465722f7463612d6170692f67726170682f62616467652e7376673f746f6b656e3d4a32434e475658455831)](https://codecov.io/gh/maikschneider/tca-api)

`TCA_API` is a TYPO3 extension that exposes database tables as **Hydra JSON-LD** resources through a configuration-driven REST API. Define which tables, columns, and operations to expose — the extension handles routing, serialization, validation, pagination, and access control.

> **State:** Beta (0.4.0) — feedback and contributions very welcome. See [GitHub Discussions](https://github.com/maikschneider/tca-api/discussions) to help validate the architecture, security model, and design decisions before they stabilize.

Motivation
----------

[](#motivation)

TYPO3 offers several existing approaches for serving content as structured data. TCA\_API was built to fill a gap where other API extensions fall short: exposing multiple resources uniformly, with minimal boilerplate and strong query efficiency.

See the [Motivation chapter](https://docs.typo3.org/p/maikschneider/tca-api/main/en-us/Motivation/Index.html) in the documentation for the full comparison.

Features
--------

[](#features)

- **Full CRUD** — List, show, create, update and delete operations
- **Hydra JSON-LD** — Responses follow the [Hydra](https://www.hydra-cg.com/) specification (`application/ld+json`)
- **Configuration-driven** — Expose tables by registering a PHP configuration array; no custom controllers needed
- **Serialization groups** — Use `groups` to control which columns appear per operation
- **Filtering** — Exact, partial, word-start, range, full-text search, and many-to-many filter strategies via query parameters; relation-path filters (`categories.title`) filter by fields of related records across one or more hops; configurable defaults and private (non-overrideable) filters; extensible via `FilterInterface`
- **Sorting** — Configurable allowed sort columns with defaults
- **Pagination** — Offset-based pagination with Hydra `PartialCollectionView` links
- **Validation** — Built-in `required`, length, range, item-count, and regex validators with structured 422 error responses; auto-derived from TCA and extensible with custom rules via `ValidatorInterface`
- **File uploads** — `multipart/form-data` file uploads on write endpoints with per-column FAL storage, size limits, and filename masks
- **Access control** — Per-operation roles: `PUBLIC`, `FE_USER`, `FE_GROUP`, `BE_USER`, `BE_ADMIN`, `OWNER` (record-level ownership), or custom callables
- **Write privilege model** — Actor-aware write context with configurable execution strategy, per-table access control, system-table deny list, and structured audit logging
- **Relation handling** — Plain IRI strings or fully embedded related records (configurable depth); create new related records inline on POST/PUT/PATCH
- **Userinfo endpoint** — Expose the authenticated FE user's own record at a configurable URL
- **OpenAPI + Swagger UI** — Auto-generated OpenAPI 3.1.0 spec and interactive Swagger UI served directly from the API prefix
- **API Platform compatible** — Responses follow the Hydra JSON-LD spec and work with [API Platform](https://api-platform.com/) and its ecosystem
- **PSR-14 events** — Hook into the request lifecycle with Before/AfterOperation and Before/AfterWrite events
- **TYPO3 DataHandler** — Write operations use TYPO3's DataHandler for safe, consistent data manipulation
- **Response caching** — Tag-based HTTP response caching for `list` and `show` operations with automatic invalidation via the TYPO3 DataHandler hook; configurable TTL and per-request bypass
- **Multi-language** — URL base segments (`/de/api/...`) and an optional `X-Locale` header resolve the TYPO3 `SiteLanguage`; queries constrain on `sys_language_uid`, translations overlay default-language rows honouring the site's `fallbackType`, `sys_language_uid = -1` records stay visible, and cache keys are language-scoped
- **Extensible handler pipeline** — Register custom operation handlers or override built-in ones from any extension
- **TCA-style overrides** — Override or extend any resource config shipped by a third-party package via `Configuration/TcaApi/Overrides/` — mirrors TYPO3's `$GLOBALS['TCA']` + `TCA/Overrides/` pattern

Requirements
------------

[](#requirements)

DependencyVersionPHP^8.2TYPO3^13.4 || ^14.3Demo
----

[](#demo)

A demo project showcasing various TCA\_API configurations is available at [maikschneider/typo3-petstore](https://github.com/maikschneider/typo3-petstore). It serves as the reference for different resource setups (currently in early stages).

Installation
------------

[](#installation)

```
composer require maikschneider/tca-api
```

Site set
--------

[](#site-set)

The extension ships a TYPO3 **site set** (`maikschneider/tca-api`). Add it to your site's `config/sites//config.yaml`:

```
dependencies:
  - maikschneider/tca-api
```

This exposes the following site settings, configurable per site in the TYPO3 backend under **Site Management → Sites → Settings**:

SettingDefaultDescription`tca_api.enabled``true`Enable or disable the API for this site`tca_api.apiPrefix``/_api/`URL prefix for all API endpoints`tca_api.defaultItemsPerPage``20`Default page size for collection responses`tca_api.allowedResources`*(empty — all)*Comma-separated list of resource names to expose; empty allows all`tca_api.debugMode``false`Return verbose error details in responses`tca_api.openApiExposed``PUBLIC`Who may access the OpenAPI spec (`PUBLIC`, `FE_USER`, `BE_USER`, `BE_ADMIN`, `NONE`)`tca_api.apiSpecTitle``TCA_API`Title shown in the OpenAPI spec and Swagger UI`tca_api.apiSpecDescription`*(empty)*Description shown in the OpenAPI spec and Swagger UI`tca_api.apiSpecVersion``1.0.0`Version string in the OpenAPI spec info block`tca_api.swaggerUiEnabled``PUBLIC`Who may access the Swagger UI (`PUBLIC`, `FE_USER`, `BE_USER`, `BE_ADMIN`, `NONE`)`tca_api.corsEnabled``false`Enable CORS support — adds headers to all API responses and handles `OPTIONS` preflight requests with a `204` response`tca_api.corsOrigin``*`Value for `Access-Control-Allow-Origin``tca_api.corsAllowCredentials``false`Include `Access-Control-Allow-Credentials: true` header (required when the client sends cookies or `Authorization` headers cross-origin)Quick start
-----------

[](#quick-start)

### 1. Create the resource configuration

[](#1-create-the-resource-configuration)

Place a PHP file in `Configuration/TcaApi/` inside any active TYPO3 extension. **No manual registration is needed** — the extension auto-discovers all `*.php` files from every active package's `Configuration/TcaApi/` directory at boot time and caches the result.

**Zero-config (read-only):** the three required keys are enough. `operations` defaults to `['list', 'show']` and both are `PUBLIC` by default — no `security` block needed:

```