The Kirby QL API takes POST requests with standard JSON objects and returns highly customized results that fit your application.
Given a POST request to:
KQL adds a new
query API endpoint to your Kirby API (i.e.
yoursite.com/api/query). This endpoint requires authentication.
You can switch off authentication in your config at your own risk:
You can use any HTTP request library in your language of choice to make regular POST requests to your
/api/query endpoint. In this example, we are using the
With the query, you can fetch data from anywhere in your Kirby site. You can query fields, pages, files, users, languages, roles and more.
When you don't pass the select option, Kirby will try to come up with the most useful result set for you. This is great for simple queries.
Fetching the Site Title
Fetching a List of Page IDs
Queries can even execute field methods.
KQL becomes really powerful by its flexible way to control the result set with the select option.
To include a property or field in your results, list them as an array. Check out our reference for available properties for pages, users, files, etc.
You can also use the object notation and pass true for each key/property you want to include.
Instead of passing true, you can also pass a string query to specify what you want to return for each key in your select object.
String queries are a perfect way to create aliases or return variations of the same field or property multiple times.
With such string queries you can of course also include nested data
You can also pass an object with a
query and a
Whenever you query a collection (pages, files, users, roles, languages) you can limit the resultset and also paginate through entries. You've probably already seen the pagination object in the results above. It is included in all results for collections, even if you didn't specify any pagination settings.
You can specify a custom limit with the limit option. The default limit for collections is 100 entries.
You can jump to any page in the resultset with the
Pagination settings also work for subqueries.
With the power of selects and subqueries you can basically query the entire site in a single request
KQL is very strict with allowed methods by default. Custom page methods, file methods or model methods are not allowed to make sure you don't miss an important security issue by accident. You can allow additional methods though.
The most straight forward way is to define allowed methods in your config.
You can also add a comment to your methods' doc blocks to allow them:
This works for model methods as well as for custom page methods, file methods or other methods defined in plugins.
You can block individual class methods that would normally be accessible by listing them in your config:
Sometimes you might want to reduce access to various parts of the system. This can be done by blocking individual methods (see above) or by blocking entire classes.
Now, access to any user is blocked.
If you want to add support for a custom class or a class in Kirby's source that is not supported yet, you can list your own interceptors in your config
You can put the class for such a custom interceptor in a plugin for example.
Interceptor classes are pretty straight forward. With the
CLASS_ALIAS you can give objects with that class a short name for KQL queries. The
$toArray property lists all methods that should be rendered if you don't run a subquery. I.e. in this case
kirby.system would render an array with the
allowedMethods method must return an array of all methods that can be access for this object. In addition to that you can also create your own custom methods in an interceptor that will then become available in KQL.
This custom method can now be used with
kirby.system.isReady in KQL and will return
yes it is!
If you want to fully allow access to an entire class without putting an interceptor in between, you can add the class to the allow list in your config:
This will introduce full access to all public class methods. This can be very risky though and you should avoid this if possible.
KQL only offers access to data in your site. It does not support any mutations. All destructive methods are blocked and cannot be accessed in queries.
- nuxt-kql: A Nuxt 3 module for KQL.