Guide 06 · Developer docs

The APIs: REST, GraphQL and custom endpoints

Every Core dna site answers three kinds of API request under /cdna-api: REST for everything, GraphQL for reads that span several entity types, and web events for endpoints you define yourself as jobs. Which fits which task, one worked request for each, and what is true of all three. Jobs were called hooks until the module was renamed Orchestration; the API's routes still use the old name.

L1–L3

Unit 05 of 07 2 pages

Credentials and access

Updated 23/10/2026 01:51

Which credential each kind of client should send, how the platform reads it, and why the same request answers a site member, a backend user and a script differently. For every API reader, and above all the integrations engineer.

Most integration bugs on Core dna are the wrong choice of credential rather than a wrong implementation of the right one, so read the first page before writing any client. It gives the order in which the platform looks for a credential and what each mistake answers, a table that picks a credential for each kind of client, API keys, a complete OAuth flow with refresh tokens, the routes open to visitors, and the difference between a member and a backend user. OAuth is the preferred credential; an API key is the older option and still works.

The second page is the single most common question from scripts on a site's own pages: a write that works from the admin and answers 403 from the page. Read it if your scripts write with the visitor's session; a server with an OAuth token or an API key never meets it.

In this unit

Read in order

01 Authentication and authorisation Most integration bugs are the wrong credential, not a wrong implementation. The five strategies in the order the platform tries them, which one each kind of client should use, API keys, a complete OAuth flow, the CSRF 403, visitor routes, and why an admin key proves nothing about production. 02 The CSRF token, and the 403 on a POST A write that works from the admin or with an API key answers 403 “Missing or invalid CSRF token” when a script on the site sends it. When the token is checked, which routes check it, where a page gets it, and the fix for each kind of client.

Objects ReferenceGenerated from the platform, so it is always current

API ReferenceEvery REST endpoint, in cURL, PHP, Python and JavaScript

Credentials and access

In this unit