API-First on 1C-Bitrix: REST, OAuth, and Caching

A client approached us with a challenge: an e-commerce site on Bitrix, a React frontend, an iOS/Android mobile app, and 1C integration. Classic components wouldn't work—they needed JSON. We developed an API-first architecture: Bitrix became the backend serving data through REST APIs. The frontend team works against a contract, unaware of info blocks. The result—an average maintenance cost savings of 35% thanks to a unified API contract, and time-to-market for new features on mobile platforms reduced by 2–3x. We have specialized in such solutions for over 10 years. We have 50+ projects where Bitrix acts as an API server. Average API response time is 80 ms under peak loads up to 5000 RPS. Contact us for a free project assessment.

API-First vs Classic Bitrix: What's the Difference?

API-first radically differs from classic development. The component bitrix:catalog.section renders HTML on the server. The API approach outputs JSON—the frontend controls rendering. This gives:

• 2–3x faster mobile app development compared to the classic approach.
• A single integration point for all clients: web, iOS, Android, B2B partners.
• Full frontend control: React/Vue SPA with SSR, Swift, Kotlin.

When Is API-First Justified?

API-first on Bitrix makes sense if:

• There are multiple frontend clients sharing the same business logic.
• You need full control over the frontend (React/Vue SPA with SSR).
• The mobile app is a full product component, not an afterthought.
• You anticipate integration with many external systems through a single entry point.

If it's just a website without a mobile app, API-first is overkill.

How to Ensure API Performance?

Without caching, an API server becomes a load generator: every hit from a mobile app means N database queries. Strategy:

• HTTP cache (Cache-Control: max-age=300, ETag): for public resources (catalog, articles). CDN caches on its side.
• Redis/Memcached: complex aggregated responses (product page = iblock data + catalog prices + stock + reviews). TTL 5–15 minutes, tag-based invalidation on data change.
• Bitrix tagged cache: \Bitrix\Main\Data\TaggedCache—invalidate cache for a specific product when it is updated via 1C exchange.

Key Technical Solutions

Architecture

Clients ├── React SPA (web) ├── React Native / Swift / Kotlin (mobile) └── External systems (B2B partners, ERP) ↓ HTTPS/JSON API layer (custom REST endpoints on Bitrix) ↓ Business logic (modules catalog, sale, iblock, custom) ↓ Database (MySQL/PostgreSQL) 

Implementing REST Endpoints

In Bitrix24 and 1C-Bitrix (on-premise), there is a mechanism to register custom REST methods via the event OnRestServiceBuildDescription. According to 1C-Bitrix documentation, this is the standard path.

// /local/modules/vendor.api/lib/resthandler.php class RestHandler { public static function onRestServiceBuildDescription(): array { return [ 'vendor' => [ 'catalog.product.list' => [ 'callback' => [self::class, 'getCatalogProducts'], 'options' => ['private' => false], ], 'catalog.product.get' => [ 'callback' => [self::class, 'getCatalogProduct'], 'options' => ['private' => false], ], 'sale.order.create' => [ 'callback' => [self::class, 'createOrder'], 'options' => ['private' => false], ], ], ]; } } 

An alternative is a controller component at a separate URL (/api/v1/) that accepts requests without using the Bitrix REST mechanism.

API Client Authorization

Comparison of methods:

OAuth 2.0 is the standard path for public API. The client gets an access_token via Authorization Code or Client Credentials flow. Tokens are stored in b_oauth_access_token. Bitrix supports OAuth out of the box via the oauth module.

JWT for server-to-server and mobile clients. Server signs JWT with its own key, client passes in Authorization: Bearer header. Verify on each request—no DB access (stateless).

API Key for B2B partners with fixed IP.

How to Version API Without Pain?

Scheme: /api/v1/catalog/products, /api/v2/catalog/products. v1 and v2 live in parallel. v1 is declared deprecated with a retirement date communicated to clients via Deprecation and Sunset headers.

OpenAPI Specification

All endpoints are documented in OpenAPI 3.0 format. The frontend team generates a typed client (TypeScript SDK, Swift/Kotlin clients), QA engineers automate testing against the specification.

Error Handling

Unified error format for all endpoints:

{ "error": { "code": "PRODUCT_NOT_FOUND", "message": "Product with ID 12345 not found", "details": {} } } 

HTTP codes are used semantically: 404—not found, 422—validation error, 429—rate limit exceeded, 503—service temporarily unavailable.

Testing

An API without tests is an API without trust. We cover:

• Unit tests on handler business logic.
• Integration tests on endpoints (PHPUnit + real test DB).
• Contract tests—verify response matches OpenAPI schema (Dredd, Schemathesis).

Process of Work

What's Included

• API design: resources, endpoints, OpenAPI specification.
• Development of REST endpoints with authorization and caching.
• Swagger UI documentation with request examples.
• Integration testing.
• Handover of source code, deployment instructions, accesses.
• Training your team on API usage.
• Support during launch phase.

How to Implement a REST Endpoint in 5 Steps

1. Define a resource and endpoints (e.g., /api/v1/catalog/products).
2. Create a handler class with methods list, get, create, update, delete.
3. Register the endpoint via the event OnRestServiceBuildDescription.
4. Add authorization (OAuth, JWT, API Key).
5. Test via Swagger UI and contract tests.

Development Phases

API-first on Bitrix is an additional abstraction layer that requires team discipline. But frontend developers work with a clean JSON contract and know nothing about components and info blocks. We guarantee quality: every project undergoes code review and load testing. Order an architecture consultation and get an assessment of your API-first solution.