Exposing REST APIs directly from TYPO3 has long meant stitching together custom middleware, hand-maintained schemas, and bespoke auth. sg_apicore removes that overhead: attribute-based routing, automatic OpenAPI 3.0 generation, and a consistent token system turn TYPO3 into a fully-fledged API backend. The request lifecycle follows TYPO3's own conventions , so the extension slots into existing installations without any middleware changes.
This TYPO3 v14 port of sgalinski's sg-apicore package adds v14 compatibility and exposes MCP tools , letting TYPO3 instances act as tool providers in AI agent environments.
Table of Contents
Overview
What we did
Features in Detail
Installation
Overview
sg_apicore is a REST and API framework for TYPO3 that combines attribute-based routing (#[ApiRoute]) on top of FastRoute, multi-API and multi-version support via ApiRegistry, and automatic OpenAPI 3.0 schemas. The Swagger UI is available at /api/{id}/v{version}/docs/ui with no extra configuration. Token-based authentication covers Opaque Bearer and JWT across FE and BE contexts (Public, Token, User, Backend) with scope enforcement, all managed centrally from a backend module that handles APIs, tokens, endpoints, rate limits, and logs.
Auto-CRUD exposes any TCA table as a REST resource through the TYPO3 DataHandler, and it is workspace-aware: drafts and versions are resolved correctly. Especially relevant for AI agent scenarios are the exposed MCP tools , which surface TYPO3 APIs directly as tools in Model Context Protocol-compatible clients.
This port requires TYPO3 ^14.3 (including cms-workspaces ^14.3) and PHP ^8.3. TYPO3 v13 is deliberately unsupported in the 14.x line. The sgalinski upstream repository is hosted on GitLab and is not publicly accessible, so the exact boundary of any proprietary parts remains partly unclear.
What we did
The bulk of the work over sgalinski's upstream sg-apicore was the TYPO3 14 port: Composer requirements were raised to ^14.3 and the CI matrix was updated to TYPO3 14. PHPStan errors in resource workspace overlays and broken auth entry points were fixed.
We also folded in a substantial upstream merge, which resolved numerous conflicts across the Router, TcaMapper, the tests, and the README. One caveat: because the upstream repo lives on sgalinski's GitLab and is not publicly accessible, the line between proprietary and public parts can only be traced so far.
Features in Detail
| Feature | Benefit |
|---|---|
| #[ApiRoute] Attribute Routing | Define routes directly in PHP attributes — no XML, no YAML |
| Multi-API / Multi-Version via ApiRegistry | Operate multiple APIs and versions in a single installation |
| OpenAPI 3.0 Generation + Swagger UI | Schema automatically generated from code, instantly accessible at /docs/ui |
| MCP Tool Exposition (JSON-RPC / SSE) | Use TYPO3 as a tool provider in AI agent environments |
| Token Auth: Opaque Bearer, JWT, FE/BE Context | Flexible auth strategies with scope enforcement per endpoint |
| Auto-CRUD for TCA Tables | Expose any TYPO3 tables as REST resources without custom controllers |
| Workspace Awareness | DataHandler operations respect drafts and workspace versions |
| Backend Module | Central management of APIs, tokens, endpoints, rate limits, and logs |
Installation
composer config repositories.sg_apicore vcs https://github.com/dirnbauer/sg_apicore.git
composer require sgalinski/sg-apicore:dev-mainFrequently Asked Questions
Conclusion
sg_apicore closes a real gap in the TYPO3 ecosystem: REST APIs, OpenAPI documentation, and MCP tools from a single extension, with no middleware glue to maintain. The v14 port makes it ready for current projects. The note about the upstream's limited transparency is deliberate: if you need certainty about licensing and origins, check this before you rely on the extension.
Our thanks go to sgalinski for the excellent sg_apicore extension. We have built on it for this TYPO3 v14 port, adding workspace fixes, MCP tool support, and v14 compatibility. The bulk of the work comes from sgalinski: the API registry, attribute-based routing, token handling, and OpenAPI documentation. The extension is licensed under GPL-2.0-or-later.