Over the last week or two a growing number of folks have been discussing improvements to the REST API. Several months back I wrote a small patch that opened the experimental REST interface to the whole API of the system. When that happened a few other people started to show some interest in what could be done with this new functionality.

There are a couple changes being worked on, and several more proposed for future work.

Currently to use the API use have to keep track of the PHPSESSID and a key that gets generated when you login. Xavier has provided a patch that resolves part of this problem by allowing the session ID to be tracked as part of the GET request instead of the cookie; we are working on a more extensive solution. In short if you are working on AJAX-like interfaces it will allow you to authenticate with an existing cookie, if you are working on a server-to-server environment, there will be a shared key to handle security. We are working to make sure we don't break compatibility for anyone out there that may be using the existing setup (I have a vendor that is doing so now for me). Xavier is looking toward building an interface that an AJAX front end can stand on, while I'm looking to make sure we enable server-to-server communication, so that outside applications can effectively sync data with CiviCRM.

At the same time, we have started to open a dialog about what features might be included in a third generation of the API. If you are a developer that has written code that works against v2, now would be a good time to start watching the API section of the forums and getting your two cents in. The community needs your feedback about what works, what doesn't work, what's missing, and anything else you have to say, to help us start to look forward to the next generation. It will be some time before v3 sees the light of day, but now is the time to start offering feedback.

Aaron Crosman
American Friends Service Committee