As others have suggested, you can patch index.php to whitelist IPs from maintenance mode. My usual solution to that is to only patch the file once and retrieve the whitelist from maintenance.flag
itself, which feels less dirty and actually makes it less error-prone:
Replace
if (file_exists($maintenanceFile)) {
with
if (file_exists($maintenanceFile) && !in_array($_SERVER['REMOTE_ADDR'], file($maintenanceFile)) {
Then add any IP that should be whitelisted to the maintenance.flag
file, separated by line break:
127.0.0.1
10.0.0.1
Since you were asking for a non-IP based solution that whitlists all API calls, I suggest this additional check at the same place of index.php:
$isApiRequest = preg_match('#^/api/#, $_SERVER['REQUEST_URI']);
if (file_exists($maintenanceFile) && !in_array($_SERVER['REMOTE_ADDR'], file($maintenanceFile) && !$isApiRequest) {
Since as long as you did not create additional rewrite rules for the API, all API entry point start with /api/
you can determine by the URI if the current request is going to the API.