A Headless CMS by Default

What sets Liferay apart from many other platforms is that headless support is not an afterthought. It’s integrated into the core architecture.

Every resource in Liferay is accessible via a structured API based on the OpenAPI specification. Developers can browse all available endpoints using the API Explorer, accessible via /o/api. This interface exposes documentation, test tools, and contract-based definitions for both REST and GraphQL endpoints. It provides everything from parameterized requests and pagination to filtering, field selection, and localization — all without needing to write or configure anything yourself.

For example, you can easily fetch web content using a REST endpoint like:

GET /o/headless-delivery/v1.0/sites/{siteId}/structured-contents?fields=title

Or craft a dynamic GraphQL query:

query {
  structuredContents(siteKey: "siteKey") {
    items {
      title
    }
  }
}

A key differentiator here is Liferay’s built-in support for external reference codes Instead of relying solely on internal database IDs, most entities — including web content, documents, and objects — can be referenced via stable external keys. External reference codes are changeable and fillable through the UI. This is particularly useful for integrations where content needs to be identified across environments or mapped from external systems.

Secure by Design: OAuth2 and Scopes

Having rich APIs is one thing. Securing them properly is another.

Liferay provides out-of-the-box OAuth2 support, allowing you to control access based on scopes, permissions, and client application types. Depending on your use case, you can configure for example:

Client credentials flow: Ideal for trusted backend-to-backend communication (e.g., an application consuming data, or a mobile app)
Authorization code flow: Best suited for user-driven authentication scenarios. Let users log in, personalize based on identity

Multiple OAuth2 applications can coexist, each with their own scopes and configurations. This gives you fine-grained control over what each client can access and whether it’s operating on behalf of a user or as a system-level integration.

Scopes can limit access to specific endpoints (e.g., read-only for objects, full access to structured content), and are enforced across all API endpoints. This makes the platform highly suitable for enterprise integrations with layered security needs.

Receiving an OAUTH token is easy:

curl -X POST \  -u 'client-id:client-secret' \  -d 'grant_type=client_credentials' \  https://your-liferay-instance/o/oauth2/token

This gives an access_token which you can use as a Bearer token in API calls to the API endpoints:

Authorization: Bearer eyJhbGciOi...

Extending the Platform: Custom APIs Without the Overhead

While the default APIs cover most needs, Liferay also gives developers the tools to define custom APIs tailored to their domain.

For code-first development, REST Builder lets you define a full API using a single YAML file, including endpoints, data models, and permissions . Liferay generates the complete implementation based on this contract specified in the YAML file: JAX-RS interfaces, DTOs, validators, and full integration with the API Explorer. It’s the fastest way to safely expose business-specific functionality.

And for teams that prefer a low-code, declarative approach, the new API Builder (introduced in 2024 Q3) enables API creation directly through the user interface. You define which entities or object fields to expose, how requests are filtered, and which operations are available — all without writing code or deploying artifacts.

Just click, configure, and publish.

Low-Code with automatic Headless API

Liferay’s Object framework offers another path: low-code APIs with enterprise structure.

Objects are reusable domain models created via the UI. Once defined, they immediately expose REST endpoints — complete with support for validation, localization, relationships, permissions, workflows, and external reference codes.

This makes it easy for functional teams or business analysts to publish structured APIs without relying on developer capacity, while maintaining IT oversight and access control.

You can query, post, or update these objects with a fully defined API.

For example, creating an object with name workshop creates the following API's:

API Explorer of Liferay

Every object gets its own namespace and endpoint structure — predictable, secure, and governed like any other resource.

Use Cases and When It Shines

Liferay’s headless capabilities unlock a wide variety of practical applications:

Lightning fast custom front-ends built with technology like next.js
Embedded apps for kiosks or digital signage (narrowcasting)
Native mobile apps
Expose dynamic content to feed custom AI Chatbots that you then integratie back into your website
Headless access to data for external CRM, DAM, or PIM tools
Partner sites or platforms reusing your content

One example from our own practice:
For one of our customers, we used Liferay’s headless APIs to integrate with a locally hosted semantic search engine. The client had strict security and compliance requirements, so public AI services were not an option.
Using the headless API, we exposed Liferay content and fed it into the external search engine for indexing. We built a custom frontend component that allowed users to ask questions in natural language. The Semantic search API then returned relevant results based on the indexed Liferay pages, providing a seamless and secure chatbot experience.
Because Liferay already exposed everything through standard, documented APIs, we didn’t need to build anything to make the content accessible. That allowed us to move fast. Focusing entirely on the frontend experience without writing custom services or exports, and the customer retained full control over data.

Conclusion

Liferay DXP isn’t just headless-capable — it’s headless by design.

With structured REST and GraphQL APIs, inbuilt support for adjustable reference codes, secure OAuth2 flows, and multiple extensibility layers (REST Builder, API Builder, and Objects), Liferay offers a modern foundation for decoupled digital experiences.

You don’t need plugins or extra licenses. You don’t need workarounds.