Decionis API
Decionis for DevelopersGitHub
HomeAPI ReferenceSDKsContext Plugin
Commerce

Read a connected Drupal site's mode

POST
/v1/drupal/status

Authenticated with the key the site received when it connected. Every Drupal site runs in Shadow today and entitlement is always null: no enforcement entitlement exists for Drupal workspaces yet. An unknown organization and a wrong key get the same 401. Read-only; safe to repeat.

Authorization

DrupalSiteKey
AuthorizationBearer <token>

The organization API key a Drupal site received, once, when it connected (connect/verify or connect/code). Only that key is accepted, compared with the hash stored at connect; another key of the same organization is refused.

In: header

Request Body

application/json

org_id*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/drupal/status" \  -H "Content-Type: application/json" \  -d '{    "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b"  }'
{  "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",  "site_url": "string",  "mode": "shadow",  "entitlement": null}

Finish connecting a Drupal site with the emailed code POST

Signed with the site key, like `connect/verify`. The code lives at most 300 seconds and allows three attempts: a wrong code answers 400 DRUPAL_CODE_INVALID, and once three have failed, 410 DRUPAL_CODE_EXHAUSTED. A correct code is claimed once and connects the site, with the same answer and the same binding as `connect/verify`. An emailed code proves the billing inbox, not the site: it may connect a new site, never take over a connected one (409 DRUPAL_SITE_ALREADY_CONNECTED). It answers 503 DRUPAL_EMAIL_CODE_UNAVAILABLE while codes cannot be checked.

Disconnect a Drupal site and revoke its key POST

Authenticated with the key the site received when it connected. Revokes that key in Decionis, for the Drupal provider only, then marks the site disconnected. If the key cannot be revoked, the answer is an error and the site stays connected, so a retry is safe. Once disconnected the key no longer authenticates, and repeating the call answers 401. The organization stays: connecting the site again binds it to the same one.