Public API
Anonymous REST for published content, the site identity endpoint, and the public API kill switch.
7 min read
The headless surface is `/api/v1/content`. It is anonymous: there are no API tokens. A Settings switch, Public API (public_api_enabled), takes the whole /api/v1 (and /api/site) prefix offline for anonymous users. Administrators and editors can still reach it. If the site is unpublished, anonymous callers get 404 unless they can view unpublished sites.
List published content
GET /api/v1/content?type=post&locale=en&limit=20| Query | Meaning |
|---|---|
type | post or page. |
slug | Filter to one slug. |
locale | Resolved against site languages. |
limit | Page size, max 100, default 20. |
cursor | Id cursor for the next page. |
Response: { items, nextCursor, total, locale }. Items are serialized published rows (id, type, title, slug, locale, excerpt, dates).
One item by slug
GET /api/v1/content/about?locale=enSite identity
GET /api/site/identity returns title, tagline, and logo for headless frontends. Public HTML still lives on /, /:segment, /:locale/:slug. GET /theme.css serves the effective theme CSS.
From `@justflows/sdk` (illustrative)
The marketing snippet on justflows.io uses a Justflows client with content.findMany. Talk to the REST routes above from any language; keep JUSTFLOWS_URL pointed at APP_URL.
Careful
Admin JSON under /api/content, /api/users, and the rest requires a session cookie plus CSRF (jf_csrf cookie and x-csrf-token header) on mutating requests. That is not the public API.