Content API reference

Send X-Api-Key with a Content credential. The key determines the environment; ?environment=test|live must agree. Browser requests require an allowed exact Origin. Server calls without Origin authenticate by key. Never use an editor session or a webhook secret as a read key.

GET /v1/content/:siteId/:collection?limit=100 returns { items, collection, meta: { siteId, environment, count, limit, nextCursor, generatedAt } }. The default page size is 100, maximum 200. count describes this page, not the whole catalogue. Follow meta.nextCursor by setting cursor on the same scoped URL until it is null. Cursors are opaque and cannot be reused across websites, environments or collections. Each item includes id, title, slug, summary, image, fields, publishedAt and updatedAt. Drafts are never returned. Update older single-request readers before enabling paginated delivery in a release.

GET /v1/content/:siteId/:collection/:slug returns { item, meta }. Former published slugs resolve to the same entry; item.canonicalSlug identifies its current public slug. Missing or unpublished entries return 404.

600 reads per key per 15 minutes. Responses are private, no-store to avoid sharing data across keys or environments. If your website maintains its own cache, invalidate it from webhooks or use a bounded revalidation interval. Key revocation, unpublishing and disabling Content apply on the next upstream request.

400: malformed limit or cursor. 401: missing, invalid or revoked key. 403: wrong website/environment/origin, disabled Content or draft access requested. 404: website, collection or published entry missing. 429: rate limit. 503: key verification unavailable. Do not interpret an error as an empty collection. Only reuse a validated snapshot within an explicit maximum age; never resurrect static entries after unpublishing.

Collections support text, date, time, number, URL, boolean and select fields (up to 30 fields). Schemas belong to the website and apply to both Test and Live. Changes to an existing collection with published entries or a Live Content integration require explicit acknowledgement of both environments. A collection serving Live additionally requires publishing access, even when you are viewing Test. The server verifies this scope from stored records; an empty console page does not bypass it. New unused collections still require only website-management access. Save the schema revision you loaded; stale edits return 409 and must be reloaded, not blindly retried. Changes that invalidate existing drafts or published snapshots are rejected. The optional events hidden flag is a website display convention, not access control: unpublish to remove an entry from the public API.