WARNING This site is for the unreleased, still under development 3.0 version of Wiki.js. Go to the current 2.5 version instead.

API

Wiki.js exposes a GraphQL API from which you can access and modify all the resources of your wiki. If you are new to GraphQL, the site How to GraphQL is a great learning resource.

GraphQL Endpoint
The GraphQL endpoint is located at path /_graphql on your wiki.js site.

You can also access this endpoint from your browser to load the GraphQL Playground tool which lets you build and test queries, as well as explore all the possible resources you can access. The docs for all available queries and mutations are accessible on the right side of the screen.

There're various client libraries available for most programming languages to easily make GraphQL queries. Desktop API clients like Postman, Insomnia and Firecamp all support GraphQL queries.

Authentication

Access to resources requires a valid API token, which can be generated from the Administration Area (under API Access).

The token must be passed in the Authorization header, as a Bearer token, of any request made to the GraphQL endpoint, e.g.:

Authorization: Bearer eyJhbGc...aXczt18H6437W

Different permission scopes are required based on the resource you wish to query / mutate. Ensure the API token you created contains these permission scopes.

Examples

The following examples expect a valid bearer token to be provided in the Authorization header, as explained in the Authentication section above.

For GraphQL Playground, you would use the following format in the HTTP Headers panel:

{ "Authorization": "Bearer eyJhbGc...aXczt18H6437W" }
INFO
Note that for simplicity, the examples below have hardcoded values. In a real-world application, it is best practice to use variables instead.

Fetch all pages

Query to fetch a list of all pages, ordered by title, returning only the id, path and title properties.

{
  pages (orderBy: TITLE) {
    id
    path
    title
  }
}

Fetch a specific page

Query to fetch a single page, with ID dc0d23e6-3309-42a7-9742-6317e9a4ba7f, returning only the path, title, createdAt and updatedAt properties.

{
  pageById (id: "dc0d23e6-3309-42a7-9742-6317e9a4ba7f") {
    path
    title
    createdAt
    updatedAt
  }
}

Fetch all groups

Query to fetch all user groups, returning only the id and name properties.

{
  groups {
    id
    name
  }
}

Search users

Query to list all users matching john in their name or email address, returning only the id, name and email properties.

{
  users (query: "john") {
    id
    name
    email
  }
}

Create New User

Mutation to create a new local user, assign it to group ID dc0d23e6-3309-42a7-9742-6317e9a4ba7f and return the generated user id. The property succeeded will be true in the response if the operation succeeded. Otherwise, the message property will contain the error message that prevented the user creation.

mutation {
  createUser (
    email: "john.doe@example.com"
    name: "John Doe"
    passwordRaw: "Password123"
    providerKey: "local"
    groups: [
      "dc0d23e6-3309-42a7-9742-6317e9a4ba7f"
    ]
    mustChangePassword: true
    sendWelcomeEmail: false
  ) {
    operation {
      succeeded
      message
    }
    user {
      id
    }
  }
}

Errors Reference

Mutations always return an operation object reponse. This object contains both a succeeded boolean flag and a message string. In most cases, the message will be one of the keys listed below. This allows for easy translation when shown to the user on the client side.

General

KeyDescription
ERR_FORBIDDENRequest is authenticated but doesn't have the necessary permissions.
ERR_INVALID_INPUTThe provided input is invalid.
ERR_INVALID_PATHAn invalid path was provided.
ERR_INVALID_SITEAn invalid site ID was provided.
ERR_INVALID_USERAn invalid user ID was provided.
ERR_NOT_AUTHENTICATEDRequest was made as a guest or is missing an authorization token.

Authentication

KeyDescription
ERR_DUPLICATE_ACCOUNT_EMAILAn account already exists with the same email.
ERR_EMAIL_ADDRESS_NOT_ALLOWEDThe provided email address is invalid.
ERR_EXPIRED_TOKENThe provided token is valid but has expired.
ERR_EXPIRED_VALIDATION_TOKENThe provided validation token is valid but has expired.
ERR_INACTIVE_USERUser is inactive / disabled.
ERR_INCORRECT_CURRENT_PASSWORDCurrent password mismatch.
ERR_INVALID_STRATEGYThe provided strategy ID is invalid.
ERR_INVALID_TOKENThe provided token is invalid.
ERR_INVALID_VALIDATION_TOKENThe provided validation token is invalid.
ERR_LOGIN_FAILEDGeneric login failure. For security reasons, the actual error is not returned via the API or shown to the client. Look at the server logs for the actual reason.
ERR_LOGIN_RESTRICTEDUser is not allowed to login with this strategy.
ERR_MISSING_TOKENCurrent token was not provided for a token refresh.
ERR_PASSKEY_NOT_SETUPAttempted to finalize / deactivate a passkey on an account with no prior passkey setup.
ERR_PASSWORD_TOO_SHORTThe provided password is too short.
ERR_PK_ALREADY_REGISTEREDA passkey with this authenticator has already registered.
ERR_PK_HOSTNAME_MISSINGCannot setup / authenticate a passkey on a site with a wildcard * hostname. You need to set a valid hostname for the site in the Administration Area.
ERR_PK_NAME_MISSING_OR_INVALIDPasskey name is missing or is invalid.
ERR_PK_USER_CANCELLEDPasskey registration aborted by the user.
ERR_PK_VERIFICATION_FAILEDPasskey verification failed while attempting to register a new passkey.
ERR_REGISTRATION_DISABLEDUser registration is disabled.
ERR_TFA_ALREADY_ACTIVEAttempted to setup TFA on an account with already active TFA.
ERR_TFA_INCORRECT_TOKENThe provided TFA token is invalid.
ERR_TFA_INVALID_REQUESTThe provided TFA token format is wrong or no continuation token provided.
ERR_TFA_NOT_ACTIVEAttempted to deactivate TFA on an account with no active TFA.
ERR_USER_NOT_VERIFIEDUser has not verified his account.

Files / Folders

KeyDescription
ERR_FOLDER_DUPLICATEA folder already exists at this path.
ERR_FOLDER_PARENT_INVALIDThe provided parent folder is invalid.
ERR_FOLDER_TITLE_INVALIDThe provided folder title is invalid.
ERR_INVALID_FOLDERThe provided folder ID doesn't exist.

Mail

KeyDescription
ERR_MAIL_INVALID_RECIPIENTThe provided recipient email is invalid.
ERR_MAIL_NOT_CONFIGUREDThe mail configuration is missing or incomplete.
ERR_MAIL_RENDER_FAILEDThe mail template failed to render.

Pages

KeyDescription
ERR_PAGE_ALIAS_MISSINGNo alias was provided when requesting a page from an alias.
ERR_PAGE_ALIAS_NOT_FOUNDThe alias does not exist for this site.
ERR_PAGE_ALIAS_TOO_LONGThe page alias is too long.
ERR_PAGE_DUPLICATE_ALIASThis alias already exists.
ERR_PAGE_DUPLICATE_PATHA page at this path already exists.
ERR_PAGE_INVALID_ALIASThe provided alias is invalid (e.g. invalid characters).
ERR_PAGE_INVALID_TOC_DEPTHThe provided Table of Contents min/max depth is invalid.
ERR_PAGE_MISSING_SCHEDULED_DATESThe publish state was set to Scheduled but no start / end date specified.
ERR_PAGE_NOT_FOUNDThe requested page doesn't exist.
ERR_PAGE_RELATION_ICON_INVALIDA page icon identified is invalid.
ERR_PAGE_RELATION_LABEL_MISSINGA page relation label is missing.
ERR_PAGE_RELATION_LABEL_TOOLONGA page relation label is too long.
ERR_PAGE_RELATION_TARGET_INVALIDA page relation target is invalid or too long.
ERR_PAGE_TITLE_MISSINGA page title is missing.
ERR_PAGE_UPDATE_FORBIDDENYou are not authorized to update this page.