Can't access individual drafts using REST API

[João Magalhães]

Bug description

I was trying to use the api to access individual drafts. While it works when using the collection index:

api/collections/articles/entries?filter[status:is]=draft&fields=id

{
    "data": [
        {
            "id": "28e138b9-17be-4dc5-a59b-f0dc31cf8c41"
        },
        {
            "id": "8b8359ae-5dbb-48c5-a27e-55288156079d"
        },
        {
            "id": "76987f6f-e29c-4c75-a974-caf21a538686"
        }
    ],
...
}

If doesn't work if I try to access them directly:

/api/collections/articles/entries/8b8359ae-5dbb-48c5-a27e-55288156079d

{
    "message":"Not found."
}

adding ?filter[status:is]=draft here produces the same result.

Upon further inspection the issue seems to lie here: https://github.com/statamic/cms/blob/5.x/src/Http/Controllers/API/CollectionEntriesController.php#L43

Which then leads us here:
https://github.com/statamic/cms/blob/5.x/src/Http/Controllers/API/ApiController.php#L28

And this method leaves very little room for interpretation, or a way to circumvent this easily.

For my use case I just needed to use that in preview mode, so adding this bit solved it for me:

throw_if($item->published() === false && !request()->get("live-preview"), new NotFoundHttpException);

But a more sturdy solution should be implemented.

How to reproduce

Please check above

Logs

No response

Environment

Environment
Application Name: Statamic
Laravel Version: 10.48.11
PHP Version: 8.3.0
Composer Version: 2.6.6
Environment: local
Debug Mode: ENABLED
URL: statamic.test
Maintenance Mode: OFF

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: statamic
Database: sqlite
Logs: stack / single
Mail: smtp
Queue: sync
Session: file

Statamic
Addons: 0
Antlers: runtime
Sites: 2 (English, Deutsch)
Stache Watcher: Enabled
Static Caching: Disabled
Version: 4.58.1

Installation

Existing Laravel app

Additional details

No response

[Duncan McClean]

If you only need to view draft entries while in Live Preview, you can use the "token" that's provided in the request which should give you access to the draft entry.

See https://statamic.dev/live-preview#headless-frontend-frameworks

[João Magalhães]

If you only need to view draft entries while in Live Preview, you can use the "token" that's provided in the request which should give you access to the draft entry.

See statamic.dev/live-preview#headless-frontend-frameworks

While I haven't tried this, I am sceptic it will work. The documentation only mentions GraphQL for starters.

A token query parameter will be appended to the URL automatically, which you can then pass back to Statamic in a GraphQL query, where it will know to replace the entry with the Live Preview version.

And apart from that, I was already forwarding all query parameters back to the api call, in this specific case the live-preview and the token parameters.

In a somewhat similar setup we have for another site, but using graphql, as far as I recall your suggestion worked fine.

PS: If the post is not a draft, your solution would also work with the rest api.

[Duncan McClean]

While I haven't tried this, I am sceptic it will work. The documentation only mentions GraphQL for starters.

There's an example in that section that uses the REST API:

If providing the token parameter isn't working, are you able to share the code you're using to make the API request?

I don't know much about the Headless Live Preview functionality beyond what's in the docs, so I'll leave this for someone else on the team.

[João Magalhães]

If providing the token parameter isn't working, are you able to share the code you're using to make the API request?

I don't know much about the Headless Live Preview functionality beyond what's in the docs, so I'll leave this for someone else on the team.

There are a lot of moving parts to be able to put them in just a comment here, if needs be I can provide a repository. But to be honest i don't think there is a need for it as the issue is not specifically regarding live preview (even though that is what i needed to use it for in this case), but that you can't access individual drafts using the rest api, which is not related to the method of querying as it doesn't work using fetch, curl, postman, etc.

As for the live preview, what is in the docs works, as long as the post has been published before.

[Jason Varga]

you can't access individual drafts using the rest api

I understand that you cannot access drafts on the "show" endpoint.

Do you actually need to do that, though? You also say:

For my use case I just needed to use that in preview mode

If we fix the live preview token issue, you would be able to hit the endpoint with the token and the draft will be visible.