Available APIs
- Liam Tanner (Deactivated)
- Simon Coggins
- Bryn Whyman
Totara has a number of APIs available, each with its own specific purpose:
External GraphQL API
Recommended API to use for external interactions between Totara and other systems. Available in Totara 17+.
Using the External GraphQL API | Developing for the External GraphQL API
For documentation on available external API services, see here.
AJAX GraphQL API
Recommended API to use when developing browser-based Javascript code for Totara. Available in Totara 13+.
Using the AJAX GraphQL API | Developing for the AJAX GraphQL API
Mobile GraphQL API
Designed to be used exclusively by Totara's official mobile application (Totara Mobile). Available in Totara 13+.
Using the Mobile GraphQL API | Developing for the Mobile GraphQL API
Legacy web services API
This API is not recommended, but does currently provide external access to a number of services not yet available via the GraphQL APIs. Available in all versions but now deprecated.
Using legacy web services | Developing legacy web services for Totara
The table below summarises the options and their differences in more detail.
API | Description | Status | Availability | Technology | Target audience | Endpoint location | Authentication mechanism | Notes |
|---|---|---|---|---|---|---|---|---|
'External' API | Modern, fully-featured API | Preferred external API, undergoing active development | TXP17+ | GraphQL Client-defined queries Introspection via API setting | Used by developers wanting to integrate with Totara. Implemented by Totara and partner developers wanting to extend Totara's core APIs. | /api/graphql.php | OAuth 2.0 access token | Currently has limited available services but these will grow over time. |
AJAX API | Used by Totara's client-side Javascript to obtain data from back-end server | Preferred internal API | TXP13+ | GraphQL Persisted queries only No introspection | Used by front-end developers writing Totara TUI components. Implemented by Totara and partner developers wanting to extend Totara's core TUI functionality. | /totara/webapi/ajax.php | Session ID via web cookie + CSRF token Also supports some unauthenticated 'nosession' requests | Not suitable for external access due to web cookie authentication. |
Mobile API | Used by Totara's official mobile app to obtain data from back-end server | Preferred API for mobile development | TXP13+ | GraphQL Persisted queries only No introspection | Used by the Totara mobile app. Implemented by Totara and partner developers wanting to extend Totara's mobile app. | /totara/mobile/api.php | API key passed in request header |
|
Developer API | Used by developers while developing code for Totara | Optional API for use by developers | TXP13+ | GraphQL Client-defined queries Introspection available | Developers during code development process. | /totara/webapi/dev_graphql_executor.php | Session ID via web cookie or header | Provides access to the schema of all endpoint types. |
Legacy web services | Historic API, built as part of Moodle. Does not implement services for Totara-specific functionality. | We do not recommend using where there is an 'External' API for the same service. We intend to deprecate and remove the legacy web services when the 'External' API has similar service coverage. | All versions | REST XML-RPC/SOAP | Not recommended. | /webservice/rest/server.php /webservice/xmlrpc/server.php /webservice/soap/server.php | Custom token | Limited extensibility and token security. |