API reference

The complete surface. Nothing here is hand-maintained — the interactive reference and this list are both generated from the schemas the API validates against, so they cannot drift from what the code does.

Last updated 2026-09-19

Conventions

Base URL: https://api.cmskite.com. Every path below is under it.
Authentication is Authorization: Bearer <credential>.
A session sends X-Tenant-Id; a session writing content also sends X-Project-Id. A project key sends neither — it already knows.
Request and response bodies are JSON. content-type: application/json is required on writes.
Mutations accept Idempotency-Key. A retry with the same key returns the original result for 24 hours.
Collections are cursor-paginated and carry RateLimit headers.

Content

Method	Path	What it does	Credential
GET	/v1/blog/posts	List posts	Key · session · agent
GET	/v1/blog/posts/{id}	One post by id	Key · session · agent
GET	/v1/blog/posts/slug/{slug}	One post by slug	Key · session · agent
POST	/v1/blog/posts	Create a post	Session · agent
PATCH	/v1/blog/posts/{id}	Update a post	Session · agent
DELETE	/v1/blog/posts/{id}	Delete a post	Session · agent
GET	/v1/blog/search	Full-text search	Key · session · agent
GET	/v1/blog/categories	List categories	Key · session · agent
GET	/v1/blog/categories/{id}	One category	Key · session · agent
POST	/v1/blog/categories	Create a category	Session · agent
PATCH	/v1/blog/categories/{id}	Rename or move a category	Session · agent
DELETE	/v1/blog/categories/{id}	Delete a category	Session · agent
GET	/v1/blog/tags	List tags	Key · session · agent
GET	/v1/blog/tags/{id}	One tag	Key · session · agent
POST	/v1/blog/tags	Create a tag	Session · agent
PATCH	/v1/blog/tags/{id}	Update a tag	Session · agent
DELETE	/v1/blog/tags/{id}	Delete a tag	Session · agent
GET	/v1/blog/authors	List authors	Key · session · agent
GET	/v1/blog/authors/{id}	One author	Key · session · agent
POST	/v1/blog/authors	Create an author	Session · agent
PATCH	/v1/blog/authors/{id}	Update an author	Session · agent
DELETE	/v1/blog/authors/{id}	Delete an author	Session · agent
GET	/v1/blog/media	List media	Key · session · agent
POST	/v1/blog/media	Record a file, get an upload URL	Session · agent
POST	/v1/blog/media/{id}/complete	Confirm an upload finished	Session · agent
DELETE	/v1/blog/media/{id}	Delete media	Session · agent

Workspaces, projects and credentials

Method	Path	What it does	Credential
GET	/v1/overview	Workspace overview figures	Session
POST	/v1/workspaces	Create a workspace	Session · agent
DELETE	/v1/workspaces/{id}	Delete a workspace	Session (owner)
GET	/v1/projects	List projects	Session · agent
GET	/v1/projects/{id}	One project	Session · agent
GET	/v1/projects/{id}/summary	Figures for one project	Session
POST	/v1/projects	Create a project	Session · agent
DELETE	/v1/projects/{id}	Delete a project	Session (owner)
GET	/v1/projects/{projectId}/api-keys	List API keys	Session
POST	/v1/projects/{projectId}/api-keys	Create an API key	Session
DELETE	/v1/api-keys/{id}	Revoke an API key	Session
GET	/v1/agent-tokens	List agent tokens	Session
POST	/v1/agent-tokens	Create an agent token	Session
DELETE	/v1/agent-tokens/{id}	Revoke an agent token	Session
GET	/v1/audit-logs	What has happened in this workspace	Session · agent

Plan and usage

Method	Path	What it does	Credential
GET	/v1/billing	Current plan, catalogue and resolved limits	Session
GET	/v1/plan-requests	Plan changes asked for	Session
POST	/v1/plan-requests	Ask to move to another plan	Session (owner)
POST	/v1/plan-requests/{id}/withdraw	Take a request back	Session (owner)
GET	/v1/usage/summary	Usage for a period	Session
GET	/v1/usage/series	Usage over time	Session
GET	/v1/usage/endpoints	Most-used endpoints	Session
GET	/v1/usage/outcomes	Requests by outcome	Session
GET	/v1/usage/projects	Traffic per project	Session

Your own database

Method	Path	What it does	Credential
GET	/v1/projects/{id}/database	Where this project stores content	Session
POST	/v1/projects/{id}/database/test	Try a connection without saving it	Session
PUT	/v1/projects/{id}/database	Point the project at your MongoDB	Session (owner)
POST	/v1/projects/{id}/database/migrate	Copy existing content across	Session (owner)
GET	/v1/projects/{id}/database/migration	How the migration is going	Session
POST	/v1/projects/{id}/database/activate	Start serving from it	Session (owner)
GET	/v1/projects/{id}/database/export	Download everything stored	Session
DELETE	/v1/projects/{id}/database	Go back to the managed database	Session (owner)

Accounts

Method	Path	What it does	Credential
POST	/v1/auth/register	Create an account and workspace	Public
POST	/v1/auth/login	Log in	Public
POST	/v1/auth/refresh	Exchange the refresh cookie	Cookie
POST	/v1/auth/logout	Log out	Session
GET	/v1/auth/me	The current user and their workspaces	Session
POST	/v1/auth/verify-email	Verify an email address	Public
POST	/v1/auth/forgot-password	Request a reset link	Public
POST	/v1/auth/reset-password	Set a new password	Public

Versioning

The version is in the path. Adding a field or an endpoint, or adding an error code, is not breaking and happens inside v1. Removing a field, renaming one, tightening a type or changing what an error code means is breaking and requires v2.

The OpenAPI document is checked into the repository and regenerated on every release check, so a change to it has to be looked at rather than shipped by accident.