Three HTTP surfaces: the editor API behind the app, the endpoints of every published site, and the MCP endpoint for agents.
Editor API
The web app proxies /api/** to the api Worker. Requests use the HTTP-only session cookie and a CSRF check; every route checks the caller’s role on the site. A site you have no role on answers 404, the same as one that does not exist, so ids never leak. Plan limits answer 402 plan_limit.
Scripts and agents can call the same routes with a workspace API key instead: Authorization: Bearer mk_…, no cookie. The key acts as its creator in the key's workspace only. A key without the write scope may only read (403 read_only_key), and account routes such as signup, login, password and invites refuse keys (403 session_required).
Auth
| Method | Path | Purpose |
|---|---|---|
POST | /auth/signup | Create an editor account |
POST | /auth/login | Start a session (rate limited per IP and email) |
POST | /auth/logout | End the session |
GET | /auth/me | The signed-in user |
GET | /auth/realtime-token | Short-lived token for a site’s rooms |
POST | /auth/password-reset/request · /confirm | Reset a password (answers 501 until email delivery is wired) |
POST | /auth/verify-email/request · /confirm | Verify the email address (answers 501 until email delivery is wired) |
POST | /auth/invites · /invites/accept | Invite to and join a workspace (answers 501 until email delivery is wired) |
Sites and pages
| Method | Path | Purpose |
|---|---|---|
GET POST | /sites | List or create sites |
GET PATCH DELETE | /sites/:siteId | Read, rename (slug: admin) or delete a site |
GET POST | /sites/:siteId/pages | List or create pages |
GET PATCH DELETE | /pages/:pageId | Read, update or delete a page |
PUT | /pages/:pageId/doc | Replace a page document |
GET POST | /sites/:siteId/members | Site members |
GET POST | /sites/:siteId/assets | List or upload assets |
POST | /sites/:siteId/publish | Publish to staging (editor) or production (admin) |
GET | /sites/:siteId/publishes?environment= | Recent publishes of staging or production, newest first, with the live one and who published or rolled back (editor; emails for admins only) |
POST | /sites/:siteId/rollback | Roll an environment back to one of its recent publishes, { environment, publishId }: staging (editor) or production (admin) |
POST | /sites/:siteId/export | Static export ZIP (admin) |
CMS and forms
| Method | Path | Purpose |
|---|---|---|
GET POST | /sites/:siteId/collections | Collections |
GET POST | /sites/:siteId/collections/:id/items | Items |
POST | …/items/:itemId/publish · unpublish · archive | Item lifecycle |
GET | …/items/:itemId/versions | Item versions, with …/:versionId/restore |
GET | /sites/:siteId/forms/:formId/submissions(.csv) | Submissions, JSON or CSV |
Data and logic
| Method | Path | Purpose |
|---|---|---|
GET POST PATCH DELETE | /sites/:siteId/integrations | Integrations (writes: admin) |
POST | /sites/:siteId/integrations/:id/test | Test a connection |
POST | /sites/:siteId/run | Run a query or operation from the editor |
GET POST PUT DELETE | /sites/:siteId/workflows | Server workflows |
POST | /sites/:siteId/workflows/:id/test | Test run (streams over …/runs/:runId/stream) |
GET POST PATCH DELETE | /sites/:siteId/tables | Native tables and …/rows |
GET PATCH DELETE | /sites/:siteId/visitors | Visitors, and …/visitor-roles |
Platform
| Method | Path | Purpose |
|---|---|---|
GET POST DELETE | /sites/:siteId/domains | Custom domains, …/:id/refresh to re-check |
GET | /billing/plans | Plans and limits |
PUT | /billing/workspaces/:id/plan · /sites/:siteId/billing/plan | Change a plan (Stripe Checkout) |
GET POST | /catalog/templates | Templates, …/:id/use to start a site |
GET POST | /catalog/plugins | Plugin catalog; install per site at /sites/:siteId/plugins |
POST | /sites/:siteId/ai | AI edit (server-sent events) |
POST | /sites/:siteId/ai/expression | Expression assistant: write, fix or explain an expression (server-sent events) |
GET POST DELETE | /workspaces/:id/api-keys | Workspace API keys for MCP |
Published sites
# Published sites (any domain of the site)
POST /api/_forms/:formId form submission (Turnstile token required)
POST /api/_q/:name client query of a page
ALL /api/<your path> your server workflow endpoints and webhooks
POST /_auth/signup | login | logout | magic-link
GET /_auth/magic?token=… completes a magic link
GET /_auth/me the current visitor
Forms and queries are rate limited per IP. Queries of a page with an access rule pass the same rule.
MCP
POST /mcp speaks JSON-RPC (MCP streamable HTTP) with a workspace API key as the bearer token. GET /mcp answers 405: there is no server-initiated stream. Every tool, resource and error is listed in the MCP server reference.
curl -X POST https://<mcp host>/mcp \
-H 'Authorization: Bearer mk_…' \
-H 'content-type: application/json' \
-d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'