Using CMS AI Agent with Drupal
Everything you need for Drupal, in the order you will actually do it. If you are stuck, the last section has the real error messages and what each one means.
Switch these on first
- The JSON:API module switched on, under Extend in the Drupal administrator. It ships with Drupal 8.7 and newer but is off until you turn it on.
- JSON:API taken out of read-only mode. This is the one that catches people: a brand new Drupal answers every read perfectly and refuses every write. Switch on "Accept all JSON:API create, read, update, and delete operations" at /admin/config/services/jsonapi.
- The core HTTP Basic Authentication module switched on, also under Extend. Without it Drupal ignores the password entirely and every correct password is refused.
- A Drupal account for CMS AI Agent whose role has the "Access the JSON:API resource list" permission, plus permission to view and edit the content types you want managed.
Connecting your website
- In CMS AI Agent, add your website by its address — the same one you type into a browser, including https://.
- We ask the site for /jsonapi and tell you what came back: that it is Drupal, and whether its JSON:API is answering.
- Enter the Drupal username and password for the account you made. Make a separate account for this rather than using your own.
- We check the account straight away and tell you if the site is still in read-only mode — at connection time, rather than leaving you to find out the first time an assistant tries to write something.
- Choose what the connection may do: read only, write drafts, change SEO. Nothing is installed on your Drupal site — no module of ours, no file.
What you can ask for on Drupal
-
Read content
Looking at what is already on the website: the list of pages and posts, who wrote each one, when it last changed, whether it is published, and the full text of any one of them.
"Which pages have not been touched in over a year?"
-
Create content
Adding something that was not there before: a new page, a new post, a new entry of whatever kind your website uses. It arrives as a draft, with a title, the body text and a short summary, ready for you to read before anyone else can.
"Add a page about our new opening hours and leave it as a draft."
-
Edit content
Changing something that is already there: the title, the body text, the summary. You are told exactly which items were touched, and your website keeps its own history of what they said before.
"Change the phone number on the Contact page to the new one."
-
Publish content
Moving something between draft, published and private. This is the step that decides whether the public can see a page, which is why it is a thing you ask for on purpose rather than something that happens on the way past.
"Publish the draft about the Saturday market."
-
Manage images and files
Putting images and files onto the website and filling in the text that belongs with them: the title, the caption, and the alt text that a screen reader speaks and a search engine reads in place of the picture.
"Put last week's photos into the gallery and write alt text for each one."
-
Manage categories and tags
Organising content so people can find it: which category a post sits in, which tags it carries, and creating a new category or tag where there is a real need for one.
"Put all the recipe posts into the Recipes category."
-
Manage menus
The menus a visitor clicks: adding an item, renaming one, putting them in a different order, moving one underneath another.
"Add the new Opening Hours page to the main menu, after Contact."
-
Custom content types
Few websites hold only pages and posts. A property site has properties, a restaurant has dishes, a school has courses. This is working with those, in their own fields, instead of forcing everything to be a blog post.
"Add a new dish to the menu: the name, the description and the price."
-
Site information
The plain facts about the website: what it is called, what software and which version it runs, how many pages and posts it holds, which languages it is written in, and when it last changed.
"How many pages does my website have, and when was each one last updated?"
-
Administrative information
What is installed, what has an update waiting, and who has an account on the website. Reads only: it cannot install, update, activate or remove a plugin or theme, change a setting, or add or change a user.
"Is anything on my website waiting for an update?"
What it will not do on Drupal
Drupal has no way to do this, so this agent does not offer it. What it would have meant:
-
Schedule content
Setting a date and a time in the future for something to appear, so a post written on a Tuesday afternoon goes live on Monday morning with nobody at a keyboard.
-
Edit SEO information
The text that does not appear on the page but decides how the page looks in a search result and when somebody shares it: the SEO title, the description under it, and the alt text on images.
-
Bulk changes
The same change across many items at once. Nothing happens straight away: you are shown the whole list first, with the value as it is now beside the value proposed for it, and it runs only after you have said yes. It can be stopped partway and it can be undone.
-
Manage redirects
Sending an old address to a new one, so a link somebody saved or a result still sitting in Google lands on the right page instead of an error. It can also list everything that is already being sent somewhere else.
Worth knowing about Drupal
- Drupal core cannot schedule. There is no publish-on-a-future-date in Drupal itself — it comes from the Scheduler contributed module — so scheduling is not offered here rather than half-offered.
- A Drupal file has no alt text of its own. Alt text belongs to the place an image is used, not to the file, so images can be uploaded and listed but there is nothing on the file itself to label.
- Drupal core has no SEO title or description. Those come from the Metatag contributed module, and CMS AI Agent does not write through it yet — so SEO editing is claimed only where a page actually comes back carrying those fields.
- Text written to a Drupal page is given one of the site's own text formats, chosen by asking the site which it has. This matters more than it sounds: without a format Drupal stores the text as plain, and a paragraph arrives on your website showing the markup as visible characters instead of as a paragraph.
When something goes wrong
The failures people actually meet, with the exact words CMS AI Agent will show you. The message is in English wherever you are, because that is what the software says.
The site is clearly Drupal but /jsonapi gives nothing.
What you will see
What to do
Go to Extend in the Drupal administrator, find "JSON:API", tick it and save. It is part of Drupal from 8.7 onwards, so there is nothing to download — it is simply off until switched on.
The username and password are refused, and you are certain they are right.
What you will see
What to do
On Drupal a 401 means one of two quite different things, and the second is the common one: the core HTTP Basic Authentication module is off. With it off Drupal never looks at the password at all, so resetting a correct password changes nothing. Switch it on under Extend, then try again.
Reading works perfectly and every attempt to write fails.
What you will see
What to do
This is Drupal's default and it catches almost everybody. Go to /admin/config/services/jsonapi, choose "Accept all JSON:API create, read, update, and delete operations", and save. Nothing else needs changing — one switch turns every write failure on a stock Drupal into a success.
The account is accepted but cannot read content.
What you will see
What to do
Give the account's role the "Access the JSON:API resource list" permission, under People → Permissions, together with permission to view the content types you want managed.
The site answers in a browser but turns us away, often with "Not Acceptable".
What you will see
What to do
Something in front of Drupal is blocking us: a security module, Cloudflare, or the host's firewall. "Not Acceptable" is usually ModSecurity on shared hosting. Ask your host to allow requests to /jsonapi, or add an exception in the security module.