Content API and authentication

The Content API delivers your published CMS entries as JSON and lets trusted systems create and update entries. It is available on plans that include public API access.

Create an API token

Go toSettings → API Tokens(you need permission to manage content types).

Give the token a name, an optional expiration date and an optional rate limit (requests per minute; 60 when left empty).

UnderPermissions, grant actions per collection:find(list entries),findOne(read one entry),createandupdate.

Save and copy the token. It is shown only once; if you lose it, regenerate it (the old value stops working).

Endpoint URL

The token and your organization ID are part of the path. There is no authorization header.

https://your-workspace.praismahub.com/api/v1/public/{token}/{organizationId}/{collection-slug}

The easiest way to get the exact URL is to open the collection in the CMS and copy its API Endpoint, then replace {{api_key}} with your token. If your organization has its own domain, the endpoint uses that domain.

curl "https://your-workspace.praismahub.com/api/v1/public/YOUR_TOKEN/ORG_ID/blog-posts?pageSize=10"

Endpoints

GET /{token}/{organizationId}: the latest entries of every collection the token may list.

GET /{token}/{organizationId}/{collection}: list entries (needsfind).

GET /{token}/{organizationId}/{collection}/{idOrSlug}: one entry by id or slug (needsfindOne).

POST /{token}/{organizationId}/{collection}: create an entry (needscreate).

PUT /{token}/{organizationId}/{collection}/{id}: update an entry (needsupdate).

POST /{token}/{organizationId}/forms/{formId}/submit: submit a lead form, seeSubmitting forms.

Deleting entries is not possible through the API.

Keeping tokens safe

The API answers cross-origin requests, so a read token can be used from browser code. Anyone who sees the URL can use the token, so give browser code a token with read permissions only, and keep tokens with create or update on your server. API tokens are integrations: they are not tied to a person and the site's customer access rules (members-only collections) do not apply to them. Grant only the collections a token needs, and set an expiration date where you can.