endpoints.yaml
Every top-level key of config/sites/<key>/endpoints.yaml: declared endpoints with their path, methods, access, rate limit, spam controls, inputs, validation, steps and response.
config/sites/<key>/endpoints.yaml declares the site’s endpoints: enquiry and contact forms, newsletter sign-up and other actions a page posts to. Each validates its inputs, runs its steps in order and responds with a fragment or a redirect.
endpoints:
- key: contact
path: /contact
methods: [post]
access: public
rate_limit: 5/hour/ip
input:
email: { type: text, format: email, required: true, label: { en-GB: Your email address } }
message: { type: text, multiline: true, max: 2000, label: { en-GB: Your message } }
steps:
- store: { as: enquiry, retention: 90d }
- mail: { template: enquiry-receipt, to: $email }
respond:
fragment: partials/contact-sent.html
on_error: partials/contact-form.html engine-dmo dev endpoint add <key> --from recipe:enquiry (or recipe:newsletter) adds one from a recipe. Forms and submissions covers inputs, steps and responses in full.
The verb writes the endpoint and exits 0, but leaves its templates to you, so engine-dmo check fails until they exist: the respond fragments under partials/, and one email template for each mail step. A mail step’s template: enquiry-receipt is the file emails/enquiry-receipt.html in one of the site’s template roots, such as templates/_shared/emails/enquiry-receipt.html; the check’s message (which is not under templates/emails/) means the emails/ folder of any root.
Give each input’s label in every locale the site serves. check warns about a schema label missing a locale, but not about an endpoint input’s.
| Key | Type | Default | Meaning |
|---|---|---|---|
endpoints | list of objects | [] | The site’s declared endpoints |
endpoints[].access | member, public, staff | public | public, member or staff |
endpoints[].cache | string | A duration a get response may be cached for | |
endpoints[].csrf | boolean | true | Require the CSRF token. false only for a machine caller with its own authentication |
endpoints[].id | string | Written for you | The element’s stable id. Written by engine-dmo check --fix; never write or change it by hand |
endpoints[].input | object | The inputs by name, each with a type (text, boolean, relation and the rest), required, limits, label per locale and where it is read from | |
endpoints[].key | string | Required | The endpoint’s key: lower case letters, digits and hyphens. Templates name it, as in enquiryForm('contact') |
endpoints[].methods | list of string | Required | get and or post |
endpoints[].path | string | Required | The path it answers on, with placeholders such as {listing} that input can read from: path |
endpoints[].permission | string | The permission a staff or member caller needs | |
endpoints[].rate_limit | any | The class default | <count>/<window>/<key>: window second, minute, hour or day; key ip, session, person, organisation or endpoint. Such as 5/hour/ip |
endpoints[].respond | map of any | Required | Exactly one shape: fragment (a template), location (a redirect), json (a projection) or stream; plus on_error, the template for a submission with errors (not with json) |
endpoints[].spam.honeypot | boolean | endpoints.defaults.spam.honeypot | The hidden field |
endpoints[].spam.min_fill_time | string | endpoints.defaults.spam.min_fill_time | The shortest believable time to fill the form |
endpoints[].spam.proof_of_work | boolean | endpoints.defaults.spam.proof_of_work | The proof-of-work challenge |
endpoints[].steps | list of map of any | Required | What a valid submission does, in order. Core steps: mail, audit, signal, analytics, query, source, job, webhook, plugin; the Forms module adds store and the Newsletter module subscribe |
endpoints[].validation | list of objects | [] | Cross-field rules, as in a schema’s validation |
endpoints[].validation[].fields | list of string | The inputs the message is shown against | |
endpoints[].validation[].message | map of string | Required | The message per locale |
endpoints[].validation[].rule | string | Required | The rule expression, such as message != empty |
endpoints[].validation[].severity | string | error | error or warning |
routes.yaml
Every key of config/sites/<key>/routes.yaml: routes with their URI patterns per locale, index pages, nesting, pagination, facets, feeds, calendars and landing pages, the home page, configuration redirects and special pages.
plugins.yaml
Every key of config/sites/<key>/plugins.yaml: the process plugins an endpoint step calls, with their command, pinned digest, environment, granted handlers and containment.