Warning! The RK-CMS distribution is distributed exclusively through rk-cms.ru. Downloading copies from third-party resources may result in data loss or installation of malware.

API documentation

Base URL

All requests are sent over HTTPS using the POST method. Parameters are passed in the request body in JSON format.

{SITEURL}/api/v2/{ENDPOINT}/

Where:

{SITEURL} is the service domain (e.g., https://example.com)
{ENDPOINT} is the name of the method being called.

Specifying the response language (optional)

To force the response language, add the language code after the domain:

{SITEURL}/{LANGUAGE}/api/v2/{ENDPOINT}/

{LANGUAGE} is the two-letter language code (en, ru, de, etc.). If not specified, the default language is used.

Authentication

Two headers must be sent for each request:

Api-ID - Your API identifier (API-ID), issued on the website.
Api-Sign - Request signature, calculated using the HMAC-SHA256 algorithm.

The Content-Type: application/json header is also required.

Signature Generation (Api-Sign)

The signature is calculated using the HMAC-SHA256 algorithm. The key is your API-KEY. The canonical JSON string of the request body is signed.

Canonical JSON Form

Request parameters are passed as an associative array. This array is serialized into a JSON object with curly braces {}. For a correct signature, you must:

- Sort the array keys alphabetically (lexicographically, ascending).
- Serialize the array to JSON without spaces (separators , and :).

The request body must always be a JSON object (an associative array).

The following fields are required:
id - a unique string up to 130 characters long, consisting only of Latin letters (a-z, A-Z) and numbers (0-9).

There are no empty arrays.

Example Request

Initial associative array (unsorted):

{"user_id": 42,"id": "a1b2c3d4e5f6g7h8i9j0..."}

Canonical signature string (after key sorting):

{"id":"a1b2c3d4e5f6g7h8i9j0...","user_id":42}

Algorithm

- Generate a unique id string (100 characters, only Latin letters and numbers).
- Prepare an object with parameters, including the required id key.
- Sort the keys alphabetically.
- Convert to a JSON string without spaces.
- Calculate the HMAC-SHA256 from this string using the API-KEY.
- Place the resulting hex digest (in lowercase) in the Api-Sign header.

Example cURL (bash)

 #!/bin/bash SITE_URL="https://example.com"API_ID="your_api_id"API_KEY="your_api_key"ACTION="get_balance" # Generating a unique id: 100 characters (hex of 50 random bytes)REQUEST_ID=$(openssl rand -hex 50) # Request body (already sorted)JSON_BODY="{\"id\":\"$REQUEST_ID\",\"user_id\":42}" # Calculate HMAC-SHA256 (requires openssl)SIGN=$(printf '%s' "$JSON_BODY" | openssl dgst -sha256 -hmac "$API_KEY" -hex | awk '{print $2}') curl -X POST "$SITE_URL/api/v2/$ACTION/" \-H "Content-Type: application/json" \-H "Api-ID: $API_ID" \-H "Api-Sign: $SIGN" \-d "$JSON_BODY"

Example PHP

 $site_url = 'https://example.com';$api_id   = 'your_api_id';$api_key  = 'your_api_key';$action   = 'get_balance'; // Generating a unique id: 100 characters (hex of 50 random bytes)$request_id = bin2hex(random_bytes(50)); // Associative array of parameters$params = ['user_id' => 42,'id'      => $request_id,]; // Sorting keysksort($params); $json_body = json_encode($params, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);$sign      = hash_hmac('sha256', $json_body, $api_key); $url       = $site_url . '/api/v2/' . $action . '/'; $headers = ['Content-Type: application/json','Api-ID: ' . $api_id,'Api-Sign: ' . $sign,]; $ch = curl_init($url);curl_setopt($ch, CURLOPT_POST, true);curl_setopt($ch, CURLOPT_POSTFIELDS, $json_body);curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);$response = curl_exec($ch);curl_close($ch); echo $response;

Example JS

 const SITE_URL = 'https://example.com';const API_ID = 'your_api_id';const API_KEY = 'your_api_key';const ACTION = 'get_balance'; // Generating a unique id: 100 characters (hex of 50 random bytes)function generateRequestId() { const bytes = new Uint8Array(50);crypto.getRandomValues(bytes); return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');} const requestId = generateRequestId(); // Parameters (associative array)const params = {user_id: 42,id: requestId}; // Sorting keysconst sortedParams = Object.keys(params).sort().reduce((acc, key) => { acc[key] = params[key]; return acc;}, {}); const jsonBody = JSON.stringify(sortedParams); // HMAC-SHA256 function via crypto.subtleasync function hmacSha256(message, secret) {const enc = new TextEncoder();const key = await crypto.subtle.importKey('raw',enc.encode(secret),{ name: 'HMAC', hash: 'SHA-256' },false,['sign']);const signature = await crypto.subtle.sign('HMAC', key, enc.encode(message)); return Array.from(new Uint8Array(signature)).map(b => b.toString(16).padStart(2, '0')).join('');} async function sendRequest() { const sign = await hmacSha256(jsonBody, API_KEY);const url = `${SITE_URL}/api/v2/${ACTION}/`; const response = await fetch(url, {method: 'POST',headers: {'Content-Type': 'application/json','Api-ID': API_ID,'Api-Sign': sign},body: jsonBody}); const data = await response.json();console.log(data);} sendRequest().catch(console.error);

Server Response

Field	Type	Description
error	integer	Error Code. 0 - success, otherwise - error code.
error_text	string	Text description of the error code (e.g., "OK", "Invalid signature").
data	any	Result of the request.

Example of a successful response

{"error": 0,"error_text": "OK","data": {"user_id": 42,"balance": "1500.75","currency": "USD"}}

Example of an error

{"error": 401,"error_text": "Invalid signature","data": ""}

Available methods

test

test method for checking the API's functionality

/api/v2/test/

parametrs

* a unique 100-character string consisting only of Latin letters (a-z, A-Z) and numbers (0-9)

result (data)

api_id

Api-ID

your IP

user_id

user ID

locale

response language

request_id

request id

RK-CMS

"I wrote this code with all my heart, infusing it with a passion for clean architecture. Every element here is carefully thought out and developed individually – this gives each plugin flexibility and confidence. I paid special attention to security issues: all potential issues have been addressed and resolved."

- From the developer

Useful

Information