API Reference

Three planes, three credentials. Full OpenAPI is served at /docs on the API host (Swagger UI) and exported to openapi.json in the repo.

PlaneAuth headerBase
DeliveryAuthorization: Bearer cms_del_…/spaces/<spaceId>/environments/<env>/delivery
PreviewAuthorization: Bearer cms_pre_…same paths as delivery (drafts visible)
ManagementAuthorization: Bearer <JWT or cms_mgm_…>resource-specific, below

Delivery & preview

List entries

curl "http://localhost:8000/spaces/<spaceId>/environments/master/delivery/entries?content_type=article&locale=fr&include=2&order=-published_at&limit=10" \
  -H "Authorization: Bearer cms_del_..."

Query params: content_type, slug, q (full-text), locale (* = raw maps), include (0–3), order (field or -field), limit, skip, and fields.<id>=<value> exact-match filters.

{
  "items": [
    {
      "id": "2b1e…",
      "content_type": "article",
      "slug": "hello-world",
      "fields": { "title": "Hello world", "body": "<p>…</p>" },
      "published_at": "2026-07-01T10:00:00Z"
    }
  ],
  "total": 1,
  "skip": 0,
  "limit": 10,
  "includes": { "entries": {}, "assets": {} }
}

Single entry / assets

GET  …/delivery/entries/{entryId}?include=2&locale=en-US
GET  …/delivery/assets?q=logo&limit=20
GET  …/delivery/assets/{assetId}
GET  /delivery/token-info            # what space/environments this token can see

Preview tokens use the same paths and additionally return draft entries with a status field.

Management (JWT or cms_mgm_… key)

AreaEndpoints
AuthPOST /auth/signup, /auth/login, /auth/refresh, /auth/switch-account, GET /auth/me
AccountsGET /accounts, invitations CRUD, GET/POST /accounts/<id>/sso
SpacesGET/POST /spaces, PATCH/DELETE /spaces/<id>
EnvironmentsGET/POST /spaces/<id>/environments, POST …/environments/<env>/clone
LocalesGET/POST /spaces/<id>/locales, PATCH/DELETE …/locales/<localeId>
Content typesGET/POST /spaces/<id>/environments/<env>/content-types, PATCH/DELETE /content-types/<id>
EntriesGET/POST /spaces/<id>/environments/<env>/entries, PATCH /entries/<id>, POST /entries/<id>/publish or unpublish or archive, versions under /entries/<id>/versions
MediaPOST /spaces/<id>/environments/<env>/media (multipart), PATCH/DELETE /media/<id>
API keysGET/POST /spaces/<id>/api-keys (token returned once)
WebhooksGET/POST /spaces/<id>/webhooks, delivery log per webhook
AIPOST /ai/generate, /ai/rewrite, /ai/translate-fields, … (see AI Features)
BillingGET /billing/plans, GET /billing/subscription, POST /billing/checkout
AuditGET /accounts/<id>/audit

Example — create an entry:

curl -X POST "http://localhost:8000/spaces/<spaceId>/environments/master/entries" \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "content_type_id": "<ctId>",
    "slug": "hello-world",
    "fields": { "title": { "en-US": "Hello world" }, "body": "<p>Hi</p>" }
  }'

Error shape

Errors return { "detail": … } — either a string or a coded object:

{ "detail": { "code": "plan_limit_reached", "metric": "entries", "limit": 500, "used": 500 } }

Common codes: sso_required (428), email_unverified (403), account_suspended (403), plan_limit_reached (402), api_quota_exceeded (429, includes Retry-After). See FAQ for fixes.