IPS4 provides an extensive REST API to provide a way to consume and create data for third-party applications and websites. Examples of things you can do include creating new topics, registering new members, updating member information, creating Commerce orders and much more besides.

Each IPS4 community provides its own instance of the API. This means that if you're building an app that community administrators can enable in their community, each community needs to create an API key for your integration to use, and REST requests are sent directly to that community - and not to a central API location operated by us.

There are two ways to authenticate requests to the REST API: using an API key (all versions), or using OAuth (4.3 and above).

When using an API key, all data is available and all actions can be performed. For example, if you send an API request to GET /forums/topics, every topic in the community will be in the results; if you send an API request to POST /forums/topics you can create a topic as any user on the community. It is therefore very important that you always keep the API Keys secret, and only grant access to the endpoints you intend to use.

Unlike with API keys, when accessing the REST API with OAuth, you will be providing an access token which has been granted to a specific user* and only data that user can see, and actions that user can perform are available. For example, if you send an API request to GET /forums/topics, only topics in forums that the authenticated user can see will be in the results; if you send an API request to POST /forums/topics the topic will be created as the authenticated user and that cannot be changed.

Some endpoints are only available when using one method or the other. For example, GET /core/me gets information about the authenticated user and so can only be used when authenticated with OAuth. Meanwhile, POST /forums/forums creates a forum, which is exclusively a site-level operation and so can only be used when authenticated with an API Key*. Some endpoints, while available to both methods, might accept different request parameters or have different response parameters for different methods which will be explained in the documentation.

* If you are familiar with OAuth and prefer using it for authentication to API Keys, you can also authenticate with Client Credentials which will work similarly to using an API Key, giving full access to the API rather than as a specific user.

Using an API Key (Easy)

The community administrator can generate API keys in AdminCP → System → REST & OAuth → API Keys. Each API Key will need to be configured to which endpoints it can access.

The way to provide the API key in your request depends on the server on which the community is running. The recommended approach is HTTP Basic Auth. Send your API key as the username, with no password. For example:

<?php
      $communityUrl = 'https://www.example.com/ips4/';
      $apiKey = 'c7a349a1629f02cd2855a58d77646f6d';
      $endpoint = '/core/hello';

      $curl = curl_init( $communityUrl . 'api' . $endpoint );
      curl_setopt_array( $curl, array(
          CURLOPT_RETURNTRANSFER	=> TRUE,
          CURLOPT_HTTPAUTH	=> CURLAUTH_BASIC,
          CURLOPT_USERPWD		=> "{$apiKey}:"
          CURLOPT_USERAGENT		=> "MyUserAgent/1.0"
      ) );
      $response = curl_exec( $curl );

If PHP is running as a CGI module (which can be confirmed by checking the phpinfo output for your server), then your server may not be able to see the Authorization header. From Invision Community 4.5 and above you may be able to send a X-Authorization header with the same base64-encoded credentials, or otherwise you will need to authorize your requests by sending your API key as the key parameter in the request. For example:

<?php
      $communityUrl = 'https://www.example.com/ips4/';
      $apiKey = 'c7a349a1629f02cd2855a58d77646f6d';
      $endpoint = '/core/hello';
      
      /* Try this approach first (requires Invision Community 4.5 or higher) */
      $curl = curl_init( $communityUrl . 'api' . $endpoint );
      curl_setopt_array( $curl, array(
          CURLOPT_RETURNTRANSFER	=> TRUE,
          CURLOPT_USERAGENT		=> "MyUserAgent/1.0",
          CURLOPT_HTTPHEADER		=> array( 'X-Authorization: ' . base64_encode( "{$apiKey}:" ) ),
      ) );
      $response = curl_exec( $curl );
      
      /* OR, if that doesn't work, use this approach */
      $curl = curl_init( $communityUrl . 'api' . $endpoint . '?key=' . $apiKey );
      curl_setopt_array( $curl, array(
          CURLOPT_RETURNTRANSFER	=> TRUE,
          CURLOPT_USERAGENT		=> "MyUserAgent/1.0"
      ) );
      $response = curl_exec( $curl );

For all GET requests, provide parameters in the query string. For PUT and POST requests, all parameters should be sent Form URL Encoded in the body.

Responses from the API are always JSON-encoded.

When an error is encountered, you will receive a response like this:

{
          "errorCode": "3S290\/7",
          "errorMessage": "INVALID_API_KEY"
      }

The possible error codes/messages for each endpoint are detailed within this documentation reference. In addition to the endpoint-specific errors, the following global errors may also be returned:

Here is a simple code snippet showing a call to the /core/hello endpoint.

<?php
      $communityUrl = 'http://www.example.com/ips4/';
      $apiKey = 'c7a349a1629f02cd2855a58d77646f6d';

      $curl = curl_init( $communityUrl . 'api/core/hello' );
      curl_setopt_array( $curl, array(
          CURLOPT_RETURNTRANSFER	=> TRUE,
          CURLOPT_HTTPAUTH	=> CURLAUTH_BASIC,
          CURLOPT_USERPWD		=> "{$apiKey}:",
          CURLOPT_USERAGENT		=> "MyUserAgent/1.0"
      ) );
      $response = curl_exec( $curl );

      echo $response;

{
      "communityName": "IPS Community Suite",
      "communityUrl": "http:\/\/localhost:8888\/ips4\/",
      "ipsVersion": "4.1.6"
      }