Backend AJAX API

These are pages which accept a POST or GET request (usually via AJAX), perform some action, and then return a response in the form of a JSON object. All backend api pages are stored in the api directory. Success, error, and warning messages are sent to the alert stream, and can be accessed via api/user_alerts.php.

activate_account.php

Activates a newly registered user account, using the activation token that was emailed to the user upon account registration or user's user_id (id column in users).

Login required: no

GET request

GET response

Possible alerts generated

• ACCOUNT_INVALID_USER_ID : Invalid user_id specified.
• ACCOUNT_TOKEN_NOT_FOUND : Invalid token specified.
• SQL_ERROR : Database error.
• ACCOUNT_ACTIVATION_COMPLETE : Account successfully activated.
• ACCOUNT_MANUALLY_ACTIVATED : Manual account activation successful.
• Authorization failed

create_action_permit.php

Adds a new action-permit mapping for a user or group.

Login required: yes

POST request

POST response

Possible alerts generated

• Invalid user_id specified.
• Invalid token specified.
• SQL_ERROR : Database error.
• Invalid action specified.
• Invalid permit(s) specified.
• Authorization failed

create_group.php

Create a new group.

Login required: yes

POST request

POST response

Possible alerts generated

• PERMISSION_NAME_IN_USE : Group name already in use.
• PERMISSION_CHAR_LIMIT : Group name too short/long.
• PERMISSION_CREATION_SUCCESSFUL : Group successfully created.
• SQL_ERROR : Database error.
• Authorization failed

create_user.php

Create a new user.

Login required: sometimes

This page can be accessed in admin or registration mode. If accessed in admin mode, authorization for the createUser secure function will be required, and the session CSRF token must be supplied. Otherwise, a new user account can be self-registered if registration is enabled in the site settings. In registration mode, all default groups will be added for the new user. Will fail if the root account has not yet been created.

POST request

POST response

Possible alerts generated

• ACCOUNT_USER_CHAR_LIMIT : Username too short/long.
• ACCOUNT_USER_INVALID_CHARACTERS : Username must be letters and numbers only.
• ACCOUNT_USERNAME_IN_USE : Username already in use.
• ACCOUNT_DISPLAY_CHAR_LIMIT : Display name too short/long.
• ACCOUNT_DISPLAYNAME_IN_USE : Display name already in use. TODO: relax this restriction?
• ACCOUNT_PASS_CHAR_LIMIT : Password too short/long.
• ACCOUNT_PASS_MISMATCH : password and passwordc do not match.
• ACCOUNT_INVALID_EMAIL : Email is not a valid email address format.
• ACCOUNT_EMAIL_IN_USE : Email address already in use.
• MAIL_ERROR : Error sending activation email (if in registration mode).
• CAPTCHA_FAIL : Captcha did not match. (if in registration mode).
• ACCOUNT_CREATION_COMPLETE : Successfully completed user account setup.
• ACCOUNT_REGISTRATION_COMPLETE_TYPE1 : Successfully created user account (no activation required).
• ACCOUNT_REGISTRATION_COMPLETE_TYPE2 : Successfully created user account (activation required).
• ACCOUNT_PERMISSION_ADDED : Successfully added user to groups (if in admin mode).
• NO_DATA : No request data was received by the script.
• SQL_ERROR : Database error.
• Authorization failed

delete_action_permit.php

Delete an action-permit mapping for a user or group.

Login required: yes

POST request

POST response

Possible alerts generated

• SQL_ERROR : Database error.
• Invalid type specified.
• Invalid action id specified.
• Successfully deleted action-permit mapping.
• Authorization failed

delete_group.php

Delete a group. Groups which have their can_delete field in the database set to 0 cannot be deleted. This is useful for certain default groups, such as users and admins.

Login required: yes

POST request

POST response

Possible alerts generated

• SQL_ERROR : Database error.
• CANNOT_DELETE_PERMISSION_GROUP : Group is not deletable (can_delete=0).
• Invalid group id specified.
• PERMISSION_DELETION_SUCCESSFUL_NAME : Group successfully deleted.
• Authorization failed

delete_user.php

Permanently delete a user account. To temporarily disable a user account instead, use the update_user.php api with enabled set to false. Note also that the root account cannot be deleted.

Login required: yes

POST request

POST response

Possible alerts generated

• SQL_ERROR : Database error.
• ACCOUNT_DELETE_MASTER : The root account cannot be deleted.
• Invalid user id specified.
• ACCOUNT_DELETIONS_SUCCESSFUL : User account successfully deleted.
• Authorization failed

load_action_permits.php

Load a list of action-permits for one or more user(s) or group(s).

Login required: yes

AJAX only: yes

GET request

GET response

{
    "group_id": 1,
    "name": "User",
    "action_permits": [
        {
            "action_id": 3,
            "action": "loadUser",
            "permits": {
                "isLoggedInUser": [
                    "user_id"
                ]
            }
        },
        {
            "action_id": 1,
            "action": "updateUserEmail",
            "permits": {
                "isLoggedInUser": [
                    "user_id"
                ]
            }
        },
        ...
    ]
}
        

[
    {
        "id": 3,
        "group_id": 1,
        "action": "loadUser",
        "permits": "isLoggedInUser(user_id)"
    },
    {
        "id": 4,
        "group_id": 1,
        "action": "loadUserGroups",
        "permits": "isLoggedInUser(user_id)"
    },
    ...
]

Possible alerts generated

• SQL_ERROR : Database error.
• user_id, group_id, or all must be specified.
• Invalid user_id, group_id, or all value specified.
• Authorization failed

load_current_user.php

Load the currently logged-in user's information.

Login required: yes

AJAX only: yes

GET request

Possible alerts generated

• SQL_ERROR: Database error.
• User is not logged in.