API Routes

This list was taken from the route definitions in the CMS repository (checked 2026-09-25, commit a92167a). Your deployment’s own /api/v1/openapi.json is the exact reference for the version you run. Which routes a frontend may call is explained in API surfaces.

Public (`/api/v1/public`)

Unauthenticated. Read-only for content.

GET  /api/v1/public/{contentType}
GET  /api/v1/public/{contentType}/{slug}
GET  /api/v1/public/media/{id}
GET  /api/v1/public/media/{id}/file
GET  /api/v1/public/media/folders/{slug}
GET  /api/v1/public/global-variables
GET  /api/v1/public/settings/{module}
GET  /api/v1/public/pages
GET  /api/v1/public/pages/by-route?route=
GET  /api/v1/public/reusable-blocks/{id}
GET  /api/v1/public/route-patterns
POST /api/v1/public/forms/{slug}/submissions
POST /api/v1/public/password-reset/request
POST /api/v1/public/password-reset/confirm
POST /api/v1/public/recovery/redeem
GET  /api/v1/public/preview/{contentType}/{slug}?token=
GET  /api/v1/public/preview/pages?route=&token=

Authentication (`/api/v1/auth`)

Better Auth, cookie sessions. Routes used by this project’s clients: sign-up/email, sign-in/email, sign-out, get-session, verify-email, send-verification-email, change-password and two-factor/{enable,verify-totp,verify-backup-code,disable,generate-backup-codes}. POST requests are rate limited.

Account (`/api/v1/account`)

A signed-in website account’s own submissions to forms that require an account. Needs a session with a verified email; POST also needs an allowed Origin. Another account’s submission, or a file that isn’t part of the submission, returns 404.

GET  /api/v1/account/forms/submissions?form=
GET  /api/v1/account/forms/submissions/{submissionId}
GET  /api/v1/account/forms/submissions/{submissionId}/files/{mediaId}
POST /api/v1/account/forms/submissions/{submissionId}/messages    multipart: body, up to 5 files

System (`/api/v1/system`, `/api/v1/health`)

GET  /api/v1/health
GET  /api/v1/system/status
POST /api/v1/system/bootstrap/request     404 once any user exists
POST /api/v1/system/bootstrap/complete    404 once any user exists
POST /api/v1/system/recover-owner         404 unless OWNER_RECOVERY_SECRET is set

Admin (`/api/v1/admin`)

Requires a CMS-role session. Not for websites. Minimum roles are noted in the guides (Users & Roles).

GET    /api/v1/admin/dashboard
GET    /api/v1/admin/audit-log
POST   /api/v1/admin/cache/purge

content-types      GET, POST  /content-types          GET, PATCH  /content-types/{id}
                   GET  /content-types/with-counts
fields             GET, POST  /content-types/{id}/fields
                   PATCH, DELETE  /content-types/{id}/fields/{fieldId}
                   PATCH  /content-types/{id}/fields/reorder
entries            GET, POST  /entries                GET, PATCH, DELETE  /entries/{id}
                   GET  /entries/export               POST  /entries/import
                   GET  /entries/{id}/preview-token
                   GET  /entries/{id}/revisions       POST  /entries/{id}/revisions/{revisionId}/restore
entry-folders      GET, POST  /entry-folders          PATCH, DELETE  /entry-folders/{id}
                   POST  /entry-folders/move
pages              GET, POST  /pages                  GET, PATCH, DELETE  /pages/{id}
                   GET  /pages/{id}/preview-token     GET  /pages/{id}/revisions
                   POST  /pages/{id}/revisions/{revisionId}/restore
                   POST  /pages/sanitize-html
templates          GET, POST  /templates              GET, PATCH, DELETE  /templates/{id}
reusable-blocks    GET, POST  /reusable-blocks        GET, PATCH, DELETE  /reusable-blocks/{id}
media              GET, POST  /media                  PATCH, DELETE  /media/{id}
                   GET  /media/{id}/file              POST  /media/move
media-folders      GET, POST  /media-folders          PATCH, DELETE  /media-folders/{id}
forms              GET, POST  /forms                  GET, PATCH  /forms/{id}
                   GET, POST  /forms/{id}/fields      PATCH, DELETE  /forms/{id}/fields/{fieldId}
                   GET  /forms/{id}/submissions       PATCH, DELETE  /forms/{id}/submissions/{submissionId}
                   GET  /forms/{id}/submissions/{submissionId}/files/{fieldName}
                   GET, POST  /forms/{id}/submissions/{submissionId}/replies
                   GET  /forms/{id}/submissions/{submissionId}/attachments/{mediaId}
                   PUT  /forms/{id}/submissions/{submissionId}/stage
                   GET  /forms/{id}/submissions/{submissionId}/stage-history
                   POST  /forms/{id}/test-submissions
submissions        GET  /submissions
global-variables   GET, POST  /global-variables       PATCH, DELETE  /global-variables/{id}
settings           GET, PUT  /settings
structured-settings GET  /structured-settings         GET, PUT  /structured-settings/{module}
                   POST  /structured-settings/migrate-legacy
email              GET  /email/limits                 POST  /email/send
users              GET, POST  /users                  DELETE  /users/{id}
                   PATCH  /users/{id}/role            PATCH  /users/{id}/disabled
                   PATCH  /users/{id}/developer-tools-access
                   GET  /users/{id}/sessions          DELETE  /users/{id}/sessions/{sessionId}
security           POST  /security/elevate            POST  /security/ownership/transfer
                   GET, DELETE  /security/recovery-codes    POST  /security/recovery-codes/generate
webhooks           GET, POST  /webhooks               PATCH, DELETE  /webhooks/{id}
                   GET  /webhooks/{id}/deliveries     POST  /webhooks/{id}/regenerate-secret
plugins            GET  /plugins                      PATCH  /plugins/{id}

All admin requests also need an allowed Origin, and viewer cannot write.

Plugin routes

/api/plugins/<id>/v1/*           session required, plugin-defined
/api/plugins/<id>/public/v1/*    unauthenticated, plugin-defined

Commerce (<id> = commerce): admin categories, products, settings, customers, orders; public categories, products, products/{slug}, cart, checkout, payments (orders/{orderId}/initialize, orders/{orderId}/verify, webhook) and the signed-in customer routes (profile, addresses, orders). See Commerce.

API Routes

Public (/api/v1/public)

Authentication (/api/v1/auth)

Account (/api/v1/account)

System (/api/v1/system, /api/v1/health)

Admin (/api/v1/admin)