© 2026 phis.dev. All rights reserved.
Brand logo
phis.dev
  • Home
  • Docs
A pair of braces around an arrow
Reference

The server API

The routes a Site and an agent speak to: what each one takes, what it answers, and who may ask.
On this page
Contents
/api/operator
/api/setup
/api/site
/api/v1/addons
/api/v1/admin
/api/v1/auth
/api/v1/email
/api/v1/entries
/api/v1/forms
/api/v1/groups
/api/v1/hooks
/api/v1/locales
/api/v1/media
/api/v1/notifications
/api/v1/site
/api/v1/tr
phis.dev
Quicklinks
Terms & Conditions
Contact

HTTP API reference

Every route handler of phis, derived from the code. Access names what the handler checks before it answers: internal token is the Site token (x-phis-token) with internal scope, API token accepts a public or internal token, and session is the visitor's Site session with the access policy the guard passes (see AUTHORIZATION.md). A route with no access entry performs its own checks or none; read its source. Request and response shapes are not listed; the source is linked per route.
161 routes.

Contents

  • /api/operator (5)
  • /api/setup (2)
  • /api/site (84)
  • /api/v1/addons (2)
  • /api/v1/admin (1)
  • /api/v1/auth (29)
  • /api/v1/email (1)
  • /api/v1/entries (2)
  • /api/v1/forms (8)
  • /api/v1/groups (3)
  • /api/v1/hooks (1)
  • /api/v1/locales (1)
  • /api/v1/media (2)
  • /api/v1/notifications (2)
  • /api/v1/site (17)
  • /api/v1/tr (1)

/api/operator

Operator console authentication.
MethodAddressAccessDescription
GET/api/operator/auth/csrf--The CSRF token the operator login form sends back. The operator console is served by this server, so it asks here rather than through a Site's /api/auth door, which reaches Core only with the Site's token.
POST/api/operator/auth/loginsetup mode (bootstrap.enabled); CSRF token
POST/api/operator/auth/logoutoperator session
POST/api/operator/auth/refreshoperator session
GET/api/operator/overview/metricsoperator session; setup mode (bootstrap.enabled)

/api/setup

MethodAddressAccessDescription
POST/api/setup/platform-super-users/clearsetup mode (bootstrap.enabled)
POST/api/setup/runtime-checksetup mode (bootstrap.enabled)

/api/site

Site administration, CMS, media and support API. A Site's /api/site proxy forwards the visitor's session.
MethodAddressAccessDescription
GET/api/site/account/avatarsession, authenticated (requireSiteAuthenticatedApiContext)
PUT/api/site/account/avatarsession, authenticated (requireSiteAuthenticatedApiContext)
DELETE/api/site/account/avatarsession, authenticated (requireSiteAuthenticatedApiContext)
GET/api/site/addon-rolessession, authenticated (requireSiteAuthenticatedApiContext)What the caller may grant, and optionally what one person already holds.
POST/api/site/addon-rolessession, authenticated (requireSiteAuthenticatedApiContext)
DELETE/api/site/addon-rolessession, authenticated (requireSiteAuthenticatedApiContext)
GET/api/site/admin/localessession, site-admin (requireSiteAdminOnlyApiContext)
PATCH/api/site/admin/localessession, site-admin (requireSiteAdminOnlyApiContext)
DELETE/api/site/admin/localessession, site-admin (requireSiteAdminOnlyApiContext)
GET/api/site/admin/logssession, developer-tools (requireSiteDeveloperApiContext)
GET/api/site/admin/logs/detailsession, developer-tools (requireSiteDeveloperApiContext)
GET/api/site/admin/mediasession, developer-tools (requireSiteDeveloperApiContext)
PATCH/api/site/admin/mediasession, developer-tools (requireSiteDeveloperApiContext)
GET/api/site/admin/settingssession, site-admin (requireSiteAdminOnlyApiContext)
PATCH/api/site/admin/settingssession, site-admin (requireSiteAdminOnlyApiContext)
GET/api/site/admin/userssession, site-admin (requireSiteAdminOnlyApiContext)
POST/api/site/admin/userssession, site-admin (requireSiteAdminOnlyApiContext)
PUT/api/site/admin/userssession, site-admin (requireSiteAdminOnlyApiContext)
PATCH/api/site/admin/userssession, site-admin (requireSiteAdminOnlyApiContext)
DELETE/api/site/admin/userssession, site-admin (requireSiteAdminOnlyApiContext)
POST/api/site/cms/areasession, structure-authoring (requireSiteBuilderApiContext)
DELETE/api/site/cms/areasession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/area/draftsession, roles (requireSiteReviewApiContext)
POST/api/site/cms/area/modulessession, structure-authoring (requireSiteBuilderApiContext)
DELETE/api/site/cms/area/modulessession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/area/modules/draftsession, roles (requireSiteReviewApiContext)
POST/api/site/cms/area/modules/publishsession, publishing (requireSitePublisherApiContext)
DELETE/api/site/cms/area/overridesession, publishing (requireSitePublisherApiContext)
POST/api/site/cms/area/publishsession, publishing (requireSitePublisherApiContext)
POST/api/site/cms/area/structuressession, roles (requireSiteReviewApiContext)
GET/api/site/cms/module-usagesession, structure-authoring (requireSiteBuilderApiContext)What a Module currently draws on this Site's published pages.
GET/api/site/cms/navigationsession, roles (requireSiteReviewApiContext)
POST/api/site/cms/navigationsession, structure-authoring (requireSiteBuilderApiContext)
DELETE/api/site/cms/navigationsession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/navigation/draftsession, roles (requireSiteReviewApiContext)
POST/api/site/cms/navigation/publishsession, publishing (requireSitePublisherApiContext)
POST/api/site/cms/pagesession, structure-authoring (requireSiteBuilderApiContext)
DELETE/api/site/cms/pagesession, structure-authoring (requireSiteBuilderApiContext)
POST/api/site/cms/page/createsession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/page/draftsession, roles (requireSiteReviewApiContext)
DELETE/api/site/cms/page/overridesession, publishing (requireSitePublisherApiContext)
POST/api/site/cms/page/publishsession, publishing (requireSitePublisherApiContext)
GET/api/site/cms/pagessession, roles (requireSiteReviewApiContext)
POST/api/site/cms/pages/{scopeId}/pathsession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/revisionssession, roles (requireSiteReviewApiContext)
DELETE/api/site/cms/revisionssession, structure-authoring (requireSiteBuilderApiContext)
POST/api/site/cms/revisions/restoresession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/themesession, roles (requireSiteReviewApiContext)
POST/api/site/cms/themesession, structure-authoring (requireSiteBuilderApiContext)
DELETE/api/site/cms/themesession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/cms/theme/draftsession, roles (requireSiteReviewApiContext)
POST/api/site/cms/theme/publishsession, publishing (requireSitePublisherApiContext)
GET/api/site/editor/contentsession, roles (requireSiteReviewApiContext)
PUT/api/site/editor/contentsession, roles (requireSiteReviewApiContext)
POST/api/site/editor/content/publishsession, publishing (requireSitePublisherApiContext)
DELETE/api/site/editor/content/publishsession, publishing (requireSitePublisherApiContext)
POST/api/site/editor/content/submitsession, roles (requireSiteReviewApiContext)
DELETE/api/site/editor/content/submitsession, roles (requireSiteReviewApiContext)
GET/api/site/editor/entries/{kind}session, content-editing (requireSiteAuthorApiContext)
PUT/api/site/editor/entries/{kind}session, content-editing (requireSiteAuthorApiContext)
DELETE/api/site/editor/entries/{kind}session, content-editing (requireSiteAuthorApiContext)
GET/api/site/editor/entries/{kind}/categoriessession, content-editing (requireSiteAuthorApiContext)
PUT/api/site/editor/entries/{kind}/categoriessession, publishing (requireSitePublisherApiContext); session, content-editing (requireSiteAuthorApiContext)
DELETE/api/site/editor/entries/{kind}/categoriessession, publishing (requireSitePublisherApiContext); session, content-editing (requireSiteAuthorApiContext)
GET/api/site/editor/entries/{kind}/curationsession, content-editing (requireSiteAuthorApiContext)
PATCH/api/site/editor/entries/{kind}/curationsession, publishing (requireSitePublisherApiContext)
POST/api/site/editor/entries/{kind}/publishsession, publishing (requireSitePublisherApiContext)
DELETE/api/site/editor/entries/{kind}/publishsession, publishing (requireSitePublisherApiContext)
POST/api/site/editor/entries/{kind}/submitsession, content-editing (requireSiteAuthorApiContext)
DELETE/api/site/editor/entries/{kind}/submitsession, content-editing (requireSiteAuthorApiContext)
POST/api/site/editor/page-metasession, content-editing (requireSiteAuthorApiContext)
GET/api/site/editor/releasessession, roles (requireSiteReviewApiContext)
GET/api/site/editor/translationssession, content-editing (requireSiteAuthorApiContext)
PATCH/api/site/editor/translationssession, publishing (requireSitePublisherApiContext)
DELETE/api/site/editor/translationssession, roles (requireSiteReviewApiContext); session, publishing (requireSitePublisherApiContext)
GET/api/site/groupssession (requireSiteGroupMemberApiContext); session, authenticated (requireSiteAuthenticatedApiContext)
POST/api/site/groupssession, developer-tools (requireSiteDeveloperApiContext)Creating a group is Site administration: a group is an authorization unit Pages, Navigation, and Assets refer to, so group membership must never confer the authority to create more of them.
PATCH/api/site/groupssession (requireSiteGroupManagerApiContext)
PUT/api/site/groupssession (requireSiteGroupManagerApiContext)
DELETE/api/site/groupssession (requireSiteGroupManagerApiContext)
GET/api/site/groups/candidatessession (requireSiteGroupManagerAnywhereApiContext)
GET/api/site/mediasession (requireMediaManagementSiteContext)
GET/api/site/media/{id}session (requireMediaAssetContext)
PATCH/api/site/media/{id}session (requireMediaAssetContext)
DELETE/api/site/media/{id}session (requireMediaAssetContext)
GET/api/site/media/{id}/contentAsset delivery policy (public Assets need no session)The bytes of one Asset, whole or in part.
HEAD/api/site/media/{id}/contentAsset delivery policy (public Assets need no session)The bytes of one Asset, whole or in part.
PUT/api/site/media/{id}/ownersession (requireMediaAssetContext)Handing one Asset over.
GET/api/site/media/{id}/subsets/{subsetKey}Asset delivery policy (public Assets need no session)
HEAD/api/site/media/{id}/subsets/{subsetKey}Asset delivery policy (public Assets need no session)
GET/api/site/media/{id}/variants/{variantKey}Asset delivery policy (public Assets need no session)
HEAD/api/site/media/{id}/variants/{variantKey}Asset delivery policy (public Assets need no session)
GET/api/site/media/folderssession (requireMediaManagementSiteContext)
POST/api/site/media/folderssession (requireMediaManagementSiteContext)
GET/api/site/media/folders/{id}session (requireMediaManagementSiteContext)
PATCH/api/site/media/folders/{id}session (requireMediaManagementSiteContext)
DELETE/api/site/media/folders/{id}session (requireMediaManagementSiteContext)
PATCH/api/site/media/spaces/{address}session, authenticated (requireSiteAuthenticatedApiContext)
PUT/api/site/media/uploads/{token}Site session, checked in the handler; session (requireMediaSpaceWriteContext)
POST/api/site/media/uploads/{token}/finalizesession (requireMediaSpaceWriteContext)
POST/api/site/media/uploads/{token}/reportSite session, checked in the handler; session (requireMediaSpaceWriteContext)
POST/api/site/media/uploads/initsession (requireMediaSpaceWriteContext)
GET/api/site/support/forwardsession, support (requireSiteSupportApiContext)Where this Site's tickets may be forwarded right now.
POST/api/site/support/forwardsession, support (requireSiteSupportApiContext)Hands one ticket's work to one target: { ticketId, target, title? }.
POST/api/site/support/linksession, support (requireSiteSupportApiContext)Links a record that already exists elsewhere to one ticket: { ticketId, reference }.
GET/api/site/support/queuessession, support (requireSiteSupportApiContext)The Site's Support queues.
POST/api/site/support/queuessession, developer-tools (requireSiteDeveloperApiContext)Adds a queue.
PATCH/api/site/support/queues/{queueId}session, developer-tools (requireSiteDeveloperApiContext)Edits one queue: its name, the group it routes to, its order, and whether it is retired.
POST/api/site/support/requestsession, authenticated (requireSiteAuthenticatedApiContext)The way in for the person asking.
GET/api/site/support/request/typessession, authenticated (requireSiteAuthenticatedApiContext)What a person who is not Staff may ask for.
GET/api/site/support/ticket-typessession, support (requireSiteSupportApiContext)The Site's ticket types.
PATCH/api/site/support/ticket-typessession, developer-tools (requireSiteDeveloperApiContext)Sets what the catalogue as a whole says: requesterWindowDays, the window every type without its own falls back to. 0 switches automatic closing off for every type at once.
POST/api/site/support/ticket-typessession, developer-tools (requireSiteDeveloperApiContext)Adds a ticket type.
PATCH/api/site/support/ticket-types/{typeId}session, developer-tools (requireSiteDeveloperApiContext)Edits one ticket type, and is where a Site decides who may ask for it.
GET/api/site/support/ticketssession, support (requireSiteSupportApiContext)
POST/api/site/support/ticketssession, support (requireSiteSupportApiContext)
GET/api/site/support/tickets/{ticketId}session, support (requireSiteSupportApiContext)
PATCH/api/site/support/tickets/{ticketId}session, support (requireSiteSupportApiContext)
POST/api/site/support/tickets/{ticketId}/assignmentsession, support (requireSiteSupportApiContext)
GET/api/site/support/tickets/{ticketId}/eventssession, support (requireSiteSupportApiContext)What happened to a ticket, oldest first: opened, moved on the ladder, taken, moved between queues, forwarded, closed. For Supporters only -- the history names queues, owners and where work was forwarded, which a requester is not told.
POST/api/site/support/tickets/{ticketId}/taskssession, support (requireSiteSupportApiContext)
PATCH/api/site/support/tickets/{ticketId}/tasks/{taskId}session, support (requireSiteSupportApiContext)
DELETE/api/site/support/tickets/{ticketId}/tasks/{taskId}session, support (requireSiteSupportApiContext)
GET/api/site/threadssession, authenticated (requireSiteAuthenticatedApiContext)
POST/api/site/threadssession, authenticated (requireSiteAuthenticatedApiContext)
GET/api/site/threads/{threadId}session, authenticated (requireSiteAuthenticatedApiContext)
PATCH/api/site/threads/{threadId}session, authenticated (requireSiteAuthenticatedApiContext)Archiving and reopening. One row carries the status, so this is the thread closing for everyone -- and therefore only for its opener, Staff, or a Manager of a group in it (setThreadStatus decides).
POST/api/site/threads/{threadId}/messagessession, authenticated (requireSiteAuthenticatedApiContext)Writing into one conversation, addressed by path.
GET/api/site/threads/{threadId}/messages/{messageId}/assets/{assetId}session, authenticated (requireSiteAuthenticatedApiContext)The bytes of one attachment, reached through the message that names it.
POST/api/site/threads/{threadId}/messages/{messageId}/translatesession, authenticated (requireSiteAuthenticatedApiContext)One message, read in another language, and nothing kept.
POST/api/site/threads/{threadId}/participantssession, authenticated (requireSiteAuthenticatedApiContext)Adds people or groups. It never removes: leaving is the participant's own flag, not somebody's edit.
POST/api/site/threads/{threadId}/readsession, authenticated (requireSiteAuthenticatedApiContext)
GET/api/site/threads/candidatessession, authenticated (requireSiteAuthenticatedApiContext)Who this person may address, and which kinds of thread this Site offers.
POST/api/site/threads/messagessession, authenticated (requireSiteAuthenticatedApiContext)The same write as /api/site/threads/{threadId}/messages, with the conversation in the body.
GET/api/site/translationsession, authenticated (requireSiteAuthenticatedApiContext)Whether this installation translates for this Site, and into what.
POST/api/site/translation/detectsession, structure-authoring (requireSiteBuilderApiContext)
GET/api/site/user-statesession, authenticated (requireSiteAuthenticatedApiContext)Everything this Site's active Modules kept about the person asking.
PATCH/api/site/user-statesession, authenticated (requireSiteAuthenticatedApiContext)One key written, every other namespace on the row untouched.
DELETE/api/site/user-statesession, authenticated (requireSiteAuthenticatedApiContext)One key removed, which is not the same as writing a falsy value.

/api/v1/addons

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
DELETE/api/v1/addons/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
GET/api/v1/addons/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
PATCH/api/v1/addons/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
POST/api/v1/addons/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
PUT/api/v1/addons/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
POST/api/v1/addons/jobsinternal tokenStarting one declared Add-on job.

/api/v1/admin

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
GET/api/v1/admin/customers/registration-profileinternal token

/api/v1/auth

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
DELETE/api/v1/auth/account/factors/{factorId}CSRF token; Site session, checked in the handler; internal token
GET/api/v1/auth/account/securitySite session, checked in the handler; internal token
DELETE/api/v1/auth/account/sessions/{sessionId}CSRF token; Site session, checked in the handler; internal token
GET/api/v1/auth/admin/installationssession (requireAuthAdminSectionReadContext)
POST/api/v1/auth/admin/installationssession (requireAuthAdminSectionContext)
PATCH/api/v1/auth/admin/installationsCSRF token; session (requireAuthAdminSectionContext); session (requireAuthAdminSectionReadContext)Collection-level update used by the descriptor Form relay (its upstream path is static): the installation key travels in the body; the applied logic is identical to the URL-addressed PATCH route.
PATCH/api/v1/auth/admin/installations/{installationKey}session (requireAuthAdminSectionContext)
DELETE/api/v1/auth/admin/installations/{installationKey}session (requireAuthAdminSectionContext)
POST/api/v1/auth/admin/installations/{installationKey}/testsession (requireAuthAdminSectionContext)
PATCH/api/v1/auth/admin/password-methodCSRF token; session (requireAuthAdminSectionContext); session (requireAuthAdminSectionReadContext)Flat section endpoint for the primary password login method. Accepts exactly the Settings Form values; the method's presentation carries over unchanged.
PATCH/api/v1/auth/admin/policyCSRF token; session (requireAuthAdminSectionContext); session (requireAuthAdminSectionReadContext)Flat section endpoint for the Auth Admin registration/linking policy. Accepts exactly the Settings Form values; every other policy field carries over unchanged.
PATCH/api/v1/auth/admin/totp-policyCSRF token; session (requireAuthAdminSectionContext); session (requireAuthAdminSectionReadContext)Flat section endpoint for the two-factor (TOTP) policy. Accepts exactly the Settings Form values; the role bitmask, the grace clearing, and the required-policy/method coupling are derived server-side.
GET/api/v1/auth/csrfinternal token
POST/api/v1/auth/logoutinternal token
GET/api/v1/auth/manifestinternal token
GET/api/v1/auth/meinternal token
POST/api/v1/auth/password/logininternal token
POST/api/v1/auth/password/reset/confirminternal token
POST/api/v1/auth/password/reset/requestinternal token
POST/api/v1/auth/profile/email/requestinternal token
PATCH/api/v1/auth/profile/localeinternal token
PATCH/api/v1/auth/profile/nameinternal token
PATCH/api/v1/auth/profile/newsletterinternal token
PATCH/api/v1/auth/profile/passwordinternal token
PATCH/api/v1/auth/profile/themeinternal token
GET/api/v1/auth/providers/{provider}/callbackinternal token
POST/api/v1/auth/providers/{provider}/startCSRF token; internal token
POST/api/v1/auth/providers/link/confirmCSRF token; internal token
GET/api/v1/auth/workflowSite session, checked in the handler; internal token
POST/api/v1/auth/workflow/totp/confirmCSRF token; Site session, checked in the handler; internal token
POST/api/v1/auth/workflow/totp/enrollCSRF token; Site session, checked in the handler; internal token
POST/api/v1/auth/workflow/verifyCSRF token; Site session, checked in the handler; internal token

/api/v1/email

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
POST/api/v1/email/sendinternal token

/api/v1/entries

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
GET/api/v1/entries/{kind}API token (public or internal)
GET/api/v1/entries/{kind}/{slug}API token (public or internal)As many relatives as a page shows under an entry; more is a list Page of its own. */ const DEFAULT_RELATED_LIMIT = 3; const MAX_RELATED_LIMIT = 12;

/api/v1/forms

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
POST/api/v1/forms/contactinternal token
GET/api/v1/forms/guardinternal token
POST/api/v1/forms/media-foldersession (requireSiteMediaApiContext)
POST/api/v1/forms/media-metadatasession (requireSiteMediaApiContext)
POST/api/v1/forms/registerinternal token
POST/api/v1/forms/register/confirminternal token
GET/api/v1/forms/register/confirm-previewinternal token
GET/api/v1/forms/registryinternal token

/api/v1/groups

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
GET/api/v1/groupssession, developer-tools (requireSiteDeveloperApiContext)
POST/api/v1/groupssession, developer-tools (requireSiteDeveloperApiContext)
GET/api/v1/groups/{groupId}/memberssession (requireSiteGroupMemberApiContext)
PUT/api/v1/groups/{groupId}/members/{userId}session (requireSiteGroupManagerApiContext)
DELETE/api/v1/groups/{groupId}/members/{userId}session (requireSiteGroupManagerApiContext)

/api/v1/hooks

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
DELETE/api/v1/hooks/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
GET/api/v1/hooks/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
PATCH/api/v1/hooks/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
POST/api/v1/hooks/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)
PUT/api/v1/hooks/{scope}/{name}/{...path?}decided per route by the Add-on dispatcher (SERVER_ADDONS.md)

/api/v1/locales

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
GET/api/v1/localesAPI token (public or internal)

/api/v1/media

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
POST/api/v1/media/checksums/recomputeinternal tokenGives Assets stored before this a digest duplicate detection can compare.
POST/api/v1/media/storage-policies/reconcileinternal tokenWrites every storage's rules from the Site registry: who may write to it, and what it is to clean up.

/api/v1/notifications

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
POST/api/v1/notifications/draininternal tokenSending what is still owed, for the operator's scheduler.
GET/api/v1/notifications/unsubscribeinternal tokenWhat the link is, without doing anything about it, so a page can be drawn from it.
POST/api/v1/notifications/unsubscribeinternal token

/api/v1/site

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
GET/api/v1/siteinternal token
GET/api/v1/site/areainternal token; session (requireSiteCmsPreviewApiContext)
GET/api/v1/site/auth/installationsinternal tokenInternal read of the Site's provider installations for server-side composition. Secrets never leave the store; the payload carries only the configured/missing status. Mutations stay on the session-guarded /api/v1/auth/admin/installations endpoints.
GET/api/v1/site/auth/settingsinternal tokenInternal read of the Auth Admin section values for server-side composition (the Admin Authentication Settings page loads its Form initial values here). Contains no provider installations and no secrets; mutations stay on the session-guarded section endpoints.
GET/api/v1/site/capabilitiesinternal token
GET/api/v1/site/contentinternal token
GET/api/v1/site/localeSite session, checked in the handler; internal token
GET/api/v1/site/media/folder-imagesinternal tokenThe public pictures of a Media Folder, for a page that shows a Folder rather than named Assets.
GET/api/v1/site/media/settingsinternal tokenInternal read of the Site's Media configuration for server-side composition (the Admin Media Settings page loads its Form initial values here). Mutations stay on the session-guarded /api/site/admin/media route; this endpoint is internal-token read-only.
GET/api/v1/site/navinternal token; session (requireSiteCmsPreviewApiContext)
GET/api/v1/site/nav/folderinternal tokenWhere a folder address of an Area leads, as a Page reference, for the Site to answer a request that found no Page with a 307. Asked on the miss path only; 404 when the address leads nowhere.
GET/api/v1/site/nav/scopesinternal token
GET/api/v1/site/pageinternal token; session (requireSiteCmsPreviewApiContext)
POST/api/v1/site/referencesinternal tokenBulk resolver for the internal reference forms defined by REFERENCES.md.
GET/api/v1/site/settingsinternal tokenInternal read of the Site's Admin settings surface for server-side composition (the Admin Settings General page loads its Form initial values here). Mutations stay on the session-guarded /api/site/admin/settings route; this endpoint is internal-token read-only.
GET/api/v1/site/statsinternal token
GET/api/v1/site/themeinternal token; session (requireSiteCmsPreviewApiContext)

/api/v1/tr

Versioned API a Site calls server-to-server with its token (x-phis-token), and the public endpoints under it.
MethodAddressAccessDescription
GET/api/v1/trAPI token (public or internal)
POST/api/v1/trAPI token (public or internal)