Every screen has an endpoint
The admin is a client of the same API you get. Mint a token in your profile, read the guide, and drive sites, pages, files, domains, routing, analytics and backups from a script - or hand the manual to an AI assistant.
Three things to know
A token is you, narrowed
Portal, Profile, API tokens: name it, choose read or read-and-write, an expiry, and optionally the tenants it may touch. It carries your capabilities and nothing more.
- Read-only or read-and-write
- Restricted to some of your tenants
- Expires; shown once
- Every call is logged
$ curl "$BASE/v1/tenants" \ -H "Authorization: Bearer $TOKEN"{ "data": [{ "id": "t_01", "name": "Harbour Kitchen", "slug": "harbour-kitchen" }]}Pages, files, versions, routing
Create pages from blocks, deploy a static ZIP, edit a file, prepare and activate a version, set the routing table. The same operations the admin uses, in the same order.
- Pages are JSON blocks you can validate
- Deploys are atomic and versioned
- Routing is one table, put whole
- Backups: export, restore, GitHub
{ "defaultHandler": "static", "rules": [ { "pathPrefix": "/blog", "handler": "builder", "access": "public" }, { "pathPrefix": "/members", "handler": "static", "access": "signed_in" } ]}The Site SDK on any page
Extensions ship as web components served from the site's own host. The builder wraps them in blocks; a static site pastes a tag. The SDK also exposes sign-in and the current session.
- cf-form, cf-booking, cf-account, cf-shop and more
- Served from your domain, no CDN
- Access enforced by the server
- Custom events into analytics with cf('event', ...)
// after the Site SDK (/vendor/cf.js) has loaded on the page:const session = await cf.auth.session();if (!session) cf.auth.signIn(); // your own events land in Website trafficcf('event', 'quote_requested', { plan: 'business' });What the API covers
Tenants
Create, list, settings, members, domains, modules.
Website
Pages, SEO, menus, media, theme, files, versions, deploy, routing, templates.
Analytics
Overview, realtime, acquisition, engagement, audience, IPs, bots, funnels, segments.
Backups
Export, restore, GitHub target, job status.
Webhooks
Subscribe to site, page, version and module events; signed deliveries.
Customers
The customer records shared by every extension.
Status
Every site's online state from the platform's own checker.
OpenAPI
The shapes at /api/v1/openapi.json; the guide regenerated from them.
{ "event": "site.version.activated", "tenantId": "t_01", "data": { "versionId": "v_42", "mode": "BLOCKS", "label": "Spring menu", "activatedAt": "2026-10-18T09:12:04.000Z" }}Build something on it
The guide is written to be followed by a person or an assistant from start to finish. If it does not answer a question, tell us.