Payments are experiencing issues due to temporary restrictions in Russia. If your payment does not go through, please submit a support request.Our support team is available 24/7 — we are always here to help with hosting and server issues.We are now accepting requests for dedicated server rental and colocation services in our data center.Reminder: we recommend enabling backups for additional data protection.A new VPS/VDS lineup with NVMe storage and improved performance is now available.Maintenance work on some servers has been completed. All services are operating normally.
REST API

MODULE FOR 1C-BITRIX

WEBKO • WEBCO

REST API

The REST API module is designed to create a programmatic interface that enables external and internal applications to interact with the site. It facilitates data exchange between resources, including other websites and mobile applications. Students use this module to study REST API principles and develop custom interfaces for coursework and diploma projects.

5.00/5 · 2 ratings

1C-Bitrix Marketplace: 5/5 · 2 ratings

Technical details

Published
6 August 2018
Updated
13 October 2026
Version
4.19.0
Installed
More than 1000 times
Responsive design
Yes
Composite support
Yes
Compatible with Sites24
No
Developer
WEBKO • WEBCO

What this solution does

The REST API module is designed to create a programmatic interface that enables external and internal applications to interact with the site. It facilitates data exchange between resources, including other websites and mobile applications.

Students use this module to study REST API principles and develop custom interfaces for coursework and diploma projects.

Important limitation: the module does not perform import of product stock levels from supplier websites. Its functionality is limited to implementing an API for data exchange, not for automatically importing information from external sources.

The REST API module is designed for organizing data exchange between platforms. A new optimized core has been developed based on experience with the previous version, providing significantly faster request processing. The update includes a routes map that allows flexible parameter configuration for each individual route. Using the module reduces development time for API interfaces and lowers overall integration costs. Support is provided by specialists with experience in creating API solutions.

The REST API module by WEBKO • WEBCO provides a ready-to-use interface with a library of built-in methods and the ability to create custom methods implementing any required logic. The system automatically generates documentation available to external developers.

The module operates via the native REST provider for 1C-Bitrix and loads before the public part of the site starts without requiring additional platform configuration. The interface is accessible via a virtual path, including the domain root, subdomain, or a custom path.

The administrative section allows configuring access to module sections for user groups. Documentation is automatically generated both within the administrative section and for clients in JSON format.

Features include support for route maps and the creation of arbitrary routes using variables in the path. Custom controllers can be assigned to routes as classes, external classes, or PHP files. Access to routes can be configured individually, incoming request parameters undergo validation, and specific routes support authentication via login and password.

The REST API module by VEBKO • WEBCO provides flexible tools for access management and request processing. It supports token-based authorization at the individual route level, user token generation, and user group verification during authorization. Specific routes support a whitelist of allowed logins and tokens, as well as the ability to deactivate routes. The system allows limiting the number of requests per unit of time for user groups, passing additional headers in responses, caching incoming requests and responses using platform tools, and maintaining a log of requests and responses. CORS configuration is available through the site's administrative panel. To accelerate interface development, the module includes helper functions, a library of built-in routes, and examples and guides for developers. A complete description of capabilities, functions, and examples is provided in the module's documentation.

Unlike the standard Bitrix REST API, which offers limited flexibility and requires the use of only pre-defined routes, this module allows creating custom routes and writing custom logic for request handling.

The REST API module by WEBKO • WEBCO extends the standard REST API implementation in Bitrix, addressing architectural inconsistencies and improving performance. The base version sometimes performs redundant operations during request processing, causing latency; this module optimizes the process for maximum response speed.

To enhance security, the module allows defining a unique access route for the API, hiding standard paths documented in public resources. This reduces the risk of attacks. You can configure the access address using a subdomain such as api, or paths like /rest, /api, or /rest-api.

Additionally, the module adds management capabilities absent in the base version: configuring the interface via the administrative panel, controlling access to routes, limiting the number of requests from a client, and logging requests and responses.

1.7. The standard 1C-Bitrix REST API currently lacks the ability to create orders via the API. This module implements the missing functionality to perform such operations.

1.8. Development and maintenance of this module are driven by user requests. However, the architecture and evolution of the 1C-Bitrix REST API are determined solely by the platform developers. Users must independently assess whether these factors are beneficial or limiting.

Environment requirements:

- Minimum PHP version 8.1 or higher, as required by the platform. Using older versions is technically possible but strongly discouraged due to the high risk of errors.

- A file for handling 404 errors (typically 404.php) containing all necessary 1C-Bitrix directives must be present in the site root directory.

- For the Apache web server, the directive ErrorDocument 404 /404.php must be added to the .htaccess file in the site root or directly in the server's main configuration file.

- For the Nginx web server, the directive error_page 404 = /404.php?$query_string; must be specified in the server section of the configuration file (typically nginx.conf).

- To ensure CORS requests function correctly, the web server must allow OPTIONS requests.

The REST API module is developed by WEBCO • WEBCO. For questions or suggestions, contact the support section where contact details are provided. Partners are eligible for individual discount conditions; contact the manager via the contacts section for details.

General iT can take care of implementing “REST API”, including installation, configuration and result verification.

UPDATE HISTORY

What’s new

4 releases
4.19.0 (28.06.2026)Latest update

Security: SQL queries in the request log have been rewritten to use the standard D7 ORM — the risk of SQL injection via filter fields and token values has been eliminated.

Security: The client IP is determined solely by REMOTE_ADDR — spoofing of X-Forwarded-For / Client-IP headers no longer affects request limits and the log.

Security: Tokens and unique codes are now generated cryptographically securely (using random_int / random_bytes instead of rand and md5); previously issued tokens remain valid.

Security: When deleting a user, the identifier is cast to an integer.

Security: The demo controller no longer returns the full $_SERVER array.

Security: Line break cleaning has been added to response headers (protection against HTTP header injection).

Security: Access control for callable classes and methods has been added for the native provider. By default, a blacklist of dangerous operations applies (arbitrary SQL, file operations and file uploads, user and group management, external HTTP requests, mailings, etc.) — ordinary read calls are unaffected. A whitelist mode is additionally supported: by overriding the route with your own class, you can allow only specific classes and methods.

Security: Protection against brute-force attacks has been added to token management routes (creation, retrieval, deletion) — if the limit of failed attempts from a single IP is exceeded, a 429 response is returned.

Security: When creating a user via the API, system fields (groups, token, service attributes) can no longer be set directly — protection against mass assignment and privilege escalation. The set of fields can be managed via a blacklist or whitelist by overriding the route with your own class.

Security: The administrative AJAX token generation now requires authorization in the admin panel, permissions for the "Security" section, and is protected against CSRF — mass token generation via external requests is no longer possible.

Security: the token field code from settings is validated as a correct identifier before being substituted into SQL — eliminating the risk of injection via administrative settings.

4.18.2 (04.02.2026)

Fixed: corrected reset of parameter values.

4.18.1 (04.02.2026)

Fixed: corrected retrieval of parameter values. Cause: after the platform update, parameter names were converted to lowercase.

Enhanced: updated the link to Documentation in the module menu.

Enhanced: improved the description of the 'Deferred Launch' parameter.

4.18.0 (04.01.2026)

Enhanced: technical update.

Enhanced: improved support for PHP versions above 8.1.

USER EXPERIENCE

Solution reviews

How does this solution work in a real project? Share your experience and help others choose.

Be the first to share your experience

There are no reviews of this solution on git.ru yet. Tell us what worked well and what could be improved.

Verified purchaseAdd a key if you wish. A verified review gets a badge, priority placement and more rating weight.

Open to every clientJust sign in to your account. A key is optional; all reviews are moderated.

YOUR EXPERIENCE MATTERS

Your review

YOUR PROJECT INFRASTRUCTURE

A home for your website

BEFORE YOU ORDER

Let’s go through the details.

What does the price cover?
The displayed price covers the solution itself. Platform licensing, installation and customisation are checked separately. If the page offers bundles, select the required option before submitting a request.
How do I check compatibility?
Compare the supported editions and solution version in the technical details with your project. Before installing on a live website, we recommend making a backup and checking the solution in a test environment.
Is there a trial?
The developer lists a trial of 14 days. The trial button opens the installer in your website control panel. Check the required features and compatibility before purchasing.
How much does this solution’s renewal cost?
The current renewal price is 11,000 ₽. Before you order, a manager will confirm the renewal period and whether it applies to your licence.
Can you help with implementation?
We can help install the module, check its settings and verify how it works in your project. Compatibility with other customisations and the scope of work are assessed before we begin.

GENERAL iT

Let’s discuss your project

Получатель: ООО «Дженерал Ай Ти Рус»

1C-BITRIX

Install solution

Enter a domain with or without https://. The installer will open in your website control panel in a new tab.

Solution screenshots

Solution screenshot