Overview

Several API fields accept rich, HTML formatted content rather than plain text. In the Loorex.com web interface these fields are edited with a built-in rich text editor; over the API you submit the HTML directly.

Submitted HTML is passed through a strict server-side sanitizer before being stored. Only the tags, attributes and style properties listed below are kept. Anything else (including <script>, inline event handlers such as onclick, and any CSS not on the allow-list) is stripped from the content.

A few tags are also disabled for specific fields regardless of sanitization — see the notes on <a> and <div>/<iframe> below.

Allowed tags and attributes

Tag	Allowed attributes	Notes
basic text formatting
<b>, <strong>	—	Bold text.
<i>, <em>	—	Italic text.
<u>	—	Underlined text.
<s>, <strike>	—	Strikethrough text.
<code>	—	Inline code.
<sup>, <sub>	—	Superscript / subscript.
structure
<p>	style	Paragraph. style is limited to text-align (left, center, right, justify).
<h1>–<h6>	style	Headings. Same text-align restriction as <p>.
<blockquote>	—	Quote block.
<pre>	—	Preformatted text block.
<hr>	—	Horizontal rule.
<center>	—	Centers its content.
<br>	—	Line break.
<ol>	—	Ordered (numbered) list.
<ul>	—	Unordered (bulleted) list.
<li>	—	List item, used inside <ol> / <ul>.
text styling
<span>	style	Inline styling. style is limited to color (hex / rgb / rgba / named color) and font-size (px, em, rem, pt or %).
<mark>	data-color, style	Highlighted text. data-color must be a valid CSS color. style is limited to background-color.
media
<img>	src, width, class	Image. src must reference an uploaded media resource, see Media resources below. width must be an integer (pixels). class is limited to img-inline. Tags without a valid src are dropped entirely.
<audio>	src, controls	Audio player. src follows the same rules as <img>.
<div> + <iframe>	div: data-youtube-video iframe: src, width, height, allowfullscreen	YouTube video embed. src must point to a youtube.com/embed/… or youtube-nocookie.com/embed/… URL, otherwise the <iframe> is dropped entirely. width / height must be integers. See example below. <div data-youtube-video=""> <iframe width="640" height="360" allowfullscreen="true" src="https://www.youtube.com/embed/LDU_Txk06tM"></iframe></div>.
links
<a>	href, target, rel	href scheme must be http, https, ftp or mailto (javascript: and any other scheme is stripped). target is limited to _blank, _self, _top.
tables
<table>, <tbody>, <colgroup>, <tr>	—	Table structure tags.
<col>	style	style is limited to width / min-width (px or %).
<td>, <th>	colspan, rowspan, colwidth	Must be integers.

Any tag, attribute or attribute value not listed above is removed while the rest of the content is kept. Unclosed tags, HTML comments and stray closing tags with no matching opening tag are also removed automatically.

Media resources

Images and audio referenced from <img>/<audio> src must be relative paths to files that were uploaded together with the same request, under the resources node — see the request examples on the individual *Create/*Update method pages linked above. Absolute URLs and URLs pointing to another domain are not accepted and will be stripped from the content.

Once a resource has been uploaded, its returned relative path can be reused in later updates without resending the resources node again.

Editing in the web interface

In the Loorex.com web interface these fields are edited using a built-in rich text editor (image/audio drag & drop and paste upload included). The HTML it produces is the same HTML accepted and sanitized by the API, so content created through the API renders identically when opened for editing on the site.