Contenter CMS API

Reads only. Authoring (create / update / publish) is exclusive to the CMS application and is not exposed here. This surface is for rendering storefronts.

Authentication

Send your tenant's CMS API key in a single header. The key is self-identifying (it resolves your tenant on its own), read-only, and static — so responses are trivially CDN-cacheable. Generate or rotate it in the CMS under Settings → API key.

X-CMS-API-Key: cms_<your-key>

Read endpoints

GET/api/storefront/pages/{site}/{locale}/{url}

The primary call for every page render — resolves the live page + its layout + the site theme in one shot, following one level of the tenant's configured site/locale fallbacks. {url} is the page path (may contain slashes); the homepage is the site root (no url segment). Optional ?version=draft (or a specific version id) fetches an unpublished version for preview — omit it for the published page. 404 when nothing matches (render your own 404).

GET/api/storefront/layouts/{site}/{locale}/{name}

A single verified live layout (standalone). locale is optional. Usually not needed — pages/resolve already returns the layout.

GET/api/storefront/themes/{site}

The site's verified live theme — CSS custom-property tokens to emit as scoped variables.

GET/api/health

Public liveness/readiness probe → { status, mode, dbOk }.

Media

There is no media endpoint to call. Every asset is public CDN content, and its absolute URL is baked into the component props inside the page/layout payloads. The browser loads it straight from the CDN — the CMS API never proxies media.

Errors

Status	Meaning
`400`	Missing/invalid `site` / `locale` / `url`.
`401`	Missing or invalid credential (API key / token).
`404`	No verified live content for that request.
`405`	Wrong method — storefront reads are `GET` only.
`429`	Quota exceeded (hard-enforce mode only).