Drupal API Endpoint Patterns

Critical Rules

ALWAYS follow these rules for ALL endpoints:

1. ALWAYS use UUIDs - never expose entity IDs.
2. ALWAYS check for existing endpoints before creating a new one.
3. NEVER use the core REST module - use custom routes.
4. ALWAYS use JSON for request/response.
5. ALWAYS implement access controls and caching.
6. Place routes in the correct module - the module that owns the functionality.
7. AVOID /api/* paths for custom routes - reserved for JSON:API.

URL Pattern Convention

Preferred pattern: /MODULE-api/resource/action