Druxt 1.3.x Makes JSON:API Resource List Configurable

Sites using Druxt can now choose which Drupal configuration resources its JSON:API access layer exposes, replacing a list of 12 resources that had been hardcoded since 2021. Stuart Clark, creator of DruxtJS, described the change in a 9 September 2026 post covering the Druxt 1.3.x release line, with the feature introduced in version 1.3.0. Updating preserves the existing resource set in configuration rather than automatically exposing additional resources, while a new settings form lets administrators select other eligible configuration entity types.

Administrators still need to account for Druxt's access model before enabling additional resources. Clark says anyone holding the access druxt resources permission can read a listed resource regardless of access rules that would otherwise deny that read, and Druxt also lifts JSON:API restrictions on filtering by fields the requester could not normally access. He argues that this model is better suited to configuration data than ordinary content, where access may vary by publication state, ownership, and field permissions. Changing the exposed-resource list requires the restricted administer druxt permission, while installing Druxt does not grant access druxt resources to any role by default.

Clark uses Drupal's rich-text configuration as a practical example. Administrators can expose editor--editor so a decoupled editing interface can read the toolbar configured for a text format, while filter_format--filter_format can provide information about enabled filters and their settings. The same configurable resource model can expose information such as image-style dimensions, content moderation states and transitions, or actions configured on the site. These additional resources are not enabled automatically, leaving administrators to decide which configuration data a frontend needs.

Version 1.3.0 also changes Druxt's default CORS configuration on sites that have not supplied their own cors.config, including the allowed methods needed for browser preflight requests. The change affects requests such as writes and reads carrying an Authorization header, while sites with custom CORS configuration remain unchanged and cross-origin cookies or sessions are not enabled by default. Drupal.org currently lists Druxt 1.3.1, released on 9 September 2026 for Drupal 10, 11, and 12, as the stable release; that patch fixes a fatal-error case on sites where JSON:API was already enabled and an incorrect status-report warning. For configuration screenshots, implementation details, and the fuller access-model explanation, read Clark's Druxt 1.3.x post.