HTTP API
Clear contracts.
Separate audiences.
Integrate through versioned HTTP modules and discover the actual contract on your own deployment. Management and public APIs are separate by design.
| Surface | Route shape | Purpose |
|---|---|---|
| Management | /api/<module>/v<major>/… | Authenticated operations; management ingress in a site deployment. |
| Public | /public/api/<module>/v<major>/… | Anonymous-capable, intentionally public representations. Public site routes require a configured site binding. |
| API document | /api/openapi.json | Management contract on your instance. |
| Public document | /public/api/openapi.json | Separate public contract on your instance. |
curl --user YOUR_USER \
http://127.0.0.1:6727/api/identity/v1/meA documented identity request. This website stores no credentials.
| Module | Representative read | Scope |
|---|---|---|
| identity/v1 | GET /api/identity/v1/me | Effective caller identity. User/group administration is deferred. |
| content/v1 | GET /api/content/v1/page?path=/content/example/en/about | Management content projection. Included by a site-enabled deployment; example path must exist. |
| site/v1 | GET /public/api/site/v1/page?path=/ | Site-relative public projection through a configured delivery binding. |
Repository paths are query parameters.
The management content API uses a fixed route and a path query parameter, rather than embedding an arbitrary repository path in the URL’s route segments. Public site paths are site-relative and resolve inside the configured binding.
The management content module also documents template-based creation, allowlisted merge-patch fields, deletion and moves. Do not apply the proposed page-lifecycle semantics to those current operations: private drafts, recoverable page deletion and /api/pages/v1 belong to the unimplemented lifecycle proposal.
Authentication and writes.
Operations use the caller’s resolver. A cookie-free machine-client write using Basic authentication must carry a non-blank X-Requested-With header; the documented convention is ContentLIBRE. A session-cookie write instead uses the CSRF token contract. /public/api is not a CSRF exemption.
The documented API does not honor If-Match for conditional writes. It rejects that header with precondition-unsupported rather than pretending to provide lost-update protection. Use the current deployment’s contract, not the future lifecycle design.
X-Requested-With: ContentLIBREHeader illustration only—not a complete mutation request. Authentication, authorization and route-specific input requirements still apply.
Documentation and error boundaries.
Where the docs feature is included, Swagger UI is self-hosted at /api/docs/ and /public/api/docs/. Those are routes on the ContentLIBRE instance, not this marketing website. This website does not embed the console or connect to a running instance.
API servlet errors that carry a body use application/problem+json. A refusal produced earlier by Sling authentication or a kernel preprocessor can have a different body. Management responses are no-store; public caching is an explicit resource opt-in subject to the identity guard.
Build the integration against your instance.
Confirm the modules in the assembly, read its OpenAPI document and test with the identities your application will use.