The complete surface. Nothing here is hand-maintained — the interactive reference and this list are both generated from the schemas the API validates against, so they cannot drift from what the code does.
Updated October 6, 2026
3 min read
Conventions
Base URL: https://api.cmskite.com. Every path below is under it.
Authentication is Authorization: Bearer <credential>.
A session sends X-Tenant-Id; a session writing content also sends X-Project-Id. A project key sends neither — it already knows.
Request and response bodies are JSON. content-type: application/json is required on writes.
Mutations accept Idempotency-Key. A retry with the same key returns the original result for 24 hours.
Collections are cursor-paginated and carry RateLimit headers.
“Agent” in the credential column means an AI tool you connected by signing in through the MCP server (see MCP and automation).
Content
Method
Path
What it does
Auth
GET
/v1/blog/posts
List posts
Key · session · agent
GET
/v1/blog/posts/{id}
One post by id
Key · session · agent
GET
/v1/blog/posts/slug/{slug}
One post by slug
Key · session · agent
POST
/v1/blog/posts
Create a post
Session · agent
PATCH
/v1/blog/posts/{id}
Update a post
Session · agent
DELETE
/v1/blog/posts/{id}
Delete a post
Session · agent
GET
/v1/blog/posts/{id}/related
Posts like this one
Key · session · agent
GET
/v1/blog/search
Full-text search
Key · session · agent
GET
/v1/blog/feed
RSS, Atom or JSON Feed
Key · session · agent
POST
/v1/blog/posts/{id}/preview
Mint a link to an unpublished post
Session · agent
GET
/v1/blog/preview/{token}
Read a draft with that link
Public (token)
GET
/v1/blog/categories
List categories
Key · session · agent
GET
/v1/blog/categories/{id}
One category
Key · session · agent
POST
/v1/blog/categories
Create a category
Session · agent
PATCH
/v1/blog/categories/{id}
Rename or move a category
Session · agent
DELETE
/v1/blog/categories/{id}
Delete a category
Session · agent
GET
/v1/blog/tags
List tags
Key · session · agent
GET
/v1/blog/tags/{id}
One tag
Key · session · agent
POST
/v1/blog/tags
Create a tag
Session · agent
PATCH
/v1/blog/tags/{id}
Update a tag
Session · agent
DELETE
/v1/blog/tags/{id}
Delete a tag
Session · agent
GET
/v1/blog/authors
List authors
Key · session · agent
GET
/v1/blog/authors/{id}
One author
Key · session · agent
POST
/v1/blog/authors
Create an author
Session · agent
PATCH
/v1/blog/authors/{id}
Update an author
Session · agent
DELETE
/v1/blog/authors/{id}
Delete an author
Session · agent
GET
/v1/blog/media
List media
Key · session · agent
POST
/v1/blog/media
Record a file, get an upload URL
Session · agent
POST
/v1/blog/media/{id}/complete
Confirm an upload finished
Session · agent
DELETE
/v1/blog/media/{id}
Delete media
Session · agent
Workspaces, projects and credentials
Method
Path
What it does
Auth
GET
/v1/overview
Workspace overview figures
Session
POST
/v1/workspaces
Create a workspace
Session · agent
DELETE
/v1/workspaces/{id}
Delete a workspace
Session (owner)
GET
/v1/projects
List projects
Session · agent
GET
/v1/projects/{id}
One project
Session · agent
GET
/v1/projects/{id}/summary
Figures for one project
Session
POST
/v1/projects
Create a project
Session · agent
PATCH
/v1/projects/{id}
Rename a project or change its settings
Session · agent
DELETE
/v1/projects/{id}
Delete a project
Session (owner)
GET
/v1/projects/{projectId}/api-keys
List API keys
Session
POST
/v1/projects/{projectId}/api-keys
Create an API key
Session
DELETE
/v1/api-keys/{id}
Revoke an API key
Session
POST
/v1/api-keys/{id}/roll
Roll an API key: a new key now, the old one stops after graceHours (0, 1, 24, 72 or 168)
Session
GET
/v1/oauth/connections
The AI tools you have connected
Session
DELETE
/v1/oauth/connections/{id}
Disconnect an AI tool
Session
GET
/v1/audit-logs
What has happened in this workspace
Session · agent
Plan and usage
Method
Path
What it does
Auth
GET
/v1/plans
The public plan catalogue and prices
Public
GET
/v1/billing
Current plan, catalogue and resolved limits
Session
POST
/v1/billing/quote
What a plan would cost at your usage
Session
GET
/v1/usage/summary
Usage for a period
Session
GET
/v1/usage/series
Usage over time
Session
GET
/v1/usage/endpoints
Most-used endpoints
Session
GET
/v1/usage/outcomes
Requests by outcome
Session
GET
/v1/usage/projects
Traffic per project
Session
GET
/v1/account/usage
Usage against every limit on the plan
Session
GET
/v1/network/egress
The IP addresses we call out from
Session
Your own database
Method
Path
What it does
Auth
GET
/v1/projects/{id}/database
Where this project stores content
Session
POST
/v1/projects/{id}/database/test
Try a connection without saving it
Session
PUT
/v1/projects/{id}/database
Point the project at your MongoDB
Session (owner)
POST
/v1/projects/{id}/database/migrate
Copy existing content across
Session (owner)
GET
/v1/projects/{id}/database/migration
How the migration is going
Session
POST
/v1/projects/{id}/database/activate
Start serving from it
Session (owner)
GET
/v1/projects/{id}/database/export
Download everything stored
Session
DELETE
/v1/projects/{id}/database
Go back to the managed database
Session (owner)
Accounts
Method
Path
What it does
Auth
GET
/v1/auth/google/start
Begin signing in with Google
Public
GET
/v1/auth/google/callback
Where Google returns to
Public
POST
/v1/auth/onboarding
Create the first workspace, when sign-in could not
Session
POST
/v1/auth/refresh
Exchange the refresh cookie
Cookie
POST
/v1/auth/logout
Log out
Session
GET
/v1/auth/me
The current user and their workspaces
Session
Reader analytics
What readers did, as opposed to what your server asked us for. Events are reported by the page that rendered the post — the SDK does this for you — and read back from rollups, never from raw events.
Method
Path
What it does
Auth
POST
/v1/blog/events
Report views and clicks
Key
GET
/v1/analytics/content/summary
Views, readers and clicks over a range
Session · agent
GET
/v1/analytics/content/top-posts
The posts readers actually read
Key · session · agent
GET
/v1/analytics/content/posts/{id}
One post: series, links pressed, referrers, countries
Session · agent
GET
/v1/analytics/content/post-totals
Totals for up to 50 posts you name
Key · session · agent
A key reads only the public figures of its own website: top posts and post totals, the numbers a site shows its readers. The range series and the per-post breakdown are yours, not your readers’, so they answer a signed-in session or a connected agent and never a key.
Team
Method
Path
What it does
Auth
GET
/v1/members
Who is in this workspace
Session
GET
/v1/members/roles
The roles a member can hold
Session
POST
/v1/members
Invite somebody
Session (admin)
PATCH
/v1/members/{id}
Change a member’s role
Session (admin)
DELETE
/v1/members/{id}
Remove a member or withdraw an invitation
Session (admin)
POST
/v1/members/{id}/resend
Send the invitation link again
Session (admin)
GET
/v1/invitations/{token}
What an invitation link is offering
Public (token)
POST
/v1/invitations/accept
Join the workspace
Session
Webhooks
Method
Path
What it does
Auth
GET
/v1/projects/{projectId}/webhooks
List webhooks
Session · agent
POST
/v1/projects/{projectId}/webhooks
Add one
Session (admin)
POST
/v1/projects/{projectId}/webhooks/{id}/status
Pause or resume one
Session (admin)
DELETE
/v1/projects/{projectId}/webhooks/{id}
Remove one
Session (admin)
GET
/v1/projects/{projectId}/webhooks/{id}/deliveries
What was sent, and what came back
Session · agent
Your own file storage
Method
Path
What it does
Auth
GET
/v1/projects/{id}/storage
Where this project stores files
Session
POST
/v1/projects/{id}/storage/test
Try credentials without saving them
Session (owner)
PUT
/v1/projects/{id}/storage
Point the project at your bucket
Session (owner)
POST
/v1/projects/{id}/storage/activate
Start serving from it
Session (owner)
DELETE
/v1/projects/{id}/storage
Go back to managed storage
Session (owner)
Versioning
The version is in the path. Adding a field or an endpoint, or adding an error code, is not breaking and happens inside v1. Removing a field, renaming one, tightening a type or changing what an error code means is breaking and requires v2.
The OpenAPI document is checked into the repository and regenerated on every release check, so a change to it has to be looked at rather than shipped by accident.
