API Reference

Everything the RIFT UI can do, the API can do — every edit, publish, and rollback runs through a versioned REST API with audit logging, idempotency keys, and a dry-run mode.

Authentication

API keys are issued from the admin panel and passed as a Bearer token. Keys are scoped, revocable, and every call made with one is attributed in the audit log.

curl -H "Authorization: Bearer cms_<your-key>" \
  https://your-instance.example.gov/api/v1/sites

Conventions

Base path — /api/v1. The version is in the path; breaking changes mean a new version, not a changed contract.
Dry run — mutating endpoints accept ?dry_run=true to validate a request fully without committing anything.
Idempotency — bulk operations accept idempotency keys, so a retried request can never double-create content.
Audit — every mutation is logged with the key, the payload context, and the outcome. If it happened, you can trace it.

Endpoint families

Family	Covers
Sites	List and configure sites, assign design systems, patch settings.
Folders	Create and manage the folder/URL tree.
Content items	CRUD on items, plus bulk create and bulk link-rewrite for migrations.
Workflow	Drive state transitions (draft → staging → public → archived) programmatically.
Publish	Trigger publishes, poll publish runs, read commit SHAs and per-run results.
Search & link graph	Query content and inspect what links to what.
Quality	Lint results, accessibility/compliance reports, redirects.
Migrations	The full migration pipeline: runs, crawling, patterns, proposals, decisions.

The OpenAPI spec

The complete, always-current contract — every path, parameter, and schema — is served by your instance itself at:

GET /api/v1/openapi.json

Point any OpenAPI tooling at it (client generators, Postman, typed SDKs). The spec is generated from the same code that serves the endpoints, so it cannot drift from reality. An MCP server built on this API also lets AI agents drive RIFT through governed, human-gated tools — the same access model, the same audit trail.