I want to update certain fields of a product (or entry) from a 3rd party.

I see some talk about plugins and some refer to this .all talk about Creating a RESTful API with Craft 3.

I found the Craft CMS Element API, but it seems to be a way to create a read-only API.

How can I update a product's fields from a 3rd party?

2 Answers 2


Tl;dr: Mutations in GraphQL seems to be the way to go - but GraphQL in Craft doesn't yet support mutations on Commerce elements. As for now, you have to create a Craft CMS Plugin. Follow the progress of mutations support on GitHub

Alternative 1 (sort of)

According to #9667 - the 3rd party CraftQL-plugin lets you do CRUD on everything* via Mutations (GraphQL way of altering data) - so that's an alternative while we wait to the native GraphQL functionality to support Mutations (see https://github.com/craftcms/cms/issues/4835 for status on that one. It's a part of the 4.0 milestone)

Also, Pixel & Tonic has added support for Mutations to the 4.0 milestone for Craft CMS on the built in GraphQL plugin. So it's coming.

* Well, not everything. CraftQL supports the following entities: entries, sites, draft, assets, globals, tags and users. The documentation contains a section about third-party field support that probably lets you implement support for mutating Craft Commerce-fields and other 3rd party fields.

I've added a Feature Request on Craft Commerce regarding GraphQL and mutations. Let's see what they answer.

Alternative 2 (only real alternative in 2019)

Also, if you can't wait for mutations in Craft Commerce, you can create your own Craft Plugin. Have a look at my question "How to accept incoming Webhooks", which helps you along with creating a plugin that can do things like creating and modifying products in Craft.


It depends on the capabilities of the 3rd party. Assuming they have the ability to trigger an http request to your Craft site, you would typically point that request to a custom controller action to trigger whatever updates you need based on the http post data.

You'll probably need to build some kind of authentication, such as checking a secret code sent by the third-party, or something more robust such as JSON Web Tokens.

The Craft 3 docs around controllers are pretty lacking at the time of writing IMO, but the V2 docs can get you most of the way there: https://docs.craftcms.com/v2/plugins/controllers.html


  • So far Craft CMS has surprised me time after time with its functionality and simplicity - but now I became a little disappointed. So what you are saying is that there is no first party API with authentication in Craft? (it would make sense to re-use the existing authentication module)
    – nitech
    Oct 14, 2019 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.