Delivery API

Read-only HTTP. No key is needed for published content.

{API}/api/v1/{siteId}/{env}/{path}

{env} is normally production. CORS is open, so a browser or a local dev server can call it directly.

Endpoints

Method	Path	Returns
GET	/{route}	One document
GET	/_partials/{key}	One partial
GET	/_routes	Every published route and partial
GET	/_redirects	Published redirects
GET	/i18n/{locale}	Strings for one language
GET	/media/{key}	File bytes (not under /api/v1)

Get a document

GET /api/v1/{siteId}/{env}/about

{
  "route": "/about",
  "meta": { "title": "About us", "description": "Who we are." },
  "zones": {
    "main": {
      "blocks": [{ "id": "hero", "type": "brand-hero", "fields": { "title": "…" } }]
    }
  }
}

The root document is the empty path. A leading slash is optional.

Cached public, max-age=0, s-maxage=60.

Get the route list

GET /api/v1/{siteId}/{env}/_routes

{
  "siteId": "…",
  "environment": "production",
  "routes": [{ "route": "/about", "type": "page", "updatedAt": "2026-09-01T18:01:27Z" }],
  "partials": ["nav", "footer"]
}

Get redirects

GET /api/v1/{siteId}/{env}/_redirects

{ "redirects": [{ "from": "/old", "to": "/new", "status": 301 }] }

Merged from both sources: redirect documents, and the meta.redirectsFrom list any document declares. Conflicting and targetless rules are left out. See Redirects.

Get strings

GET /api/v1/{siteId}/{env}/i18n/en

{ "common.buttons.save": "Save" }

Preview

Add a token to any document request:

GET /api/v1/{siteId}/{env}/{route}?previewToken={token}

or send it as X-CMS-Preview-Token. See Preview.

Response headers:

Header	Meaning
X-CMS-Preview: granted	Serving a draft.
X-CMS-Preview: granted; release	Serving a release's content.
X-CMS-Preview: denied; …	No valid credential; published content was served.

Status codes

Code	Meaning
200	Here it is.
400	Malformed path.
403	A preview token was presented and is invalid, expired, or for another site.
404	No such site, environment or document — or it exists and is not public.

A 404 for a hidden document is deliberate: it is indistinguishable from one that does not exist, so unreleased pages cannot be found by probing.

Minting a preview token

The one authenticated call your site might make. Requires a console session:

POST /api/preview-token
{ "siteId": "…", "envId": "…", "releaseId": "…" }

{ "token": "…", "expiresAt": "2026-09-03T04:00:00Z" }

releaseId is optional. Without it the token previews drafts; with it, that release.