Add a question to a quiz. Each question has 2-5 answer options and one correct answer identified by index (0-based).

Add a step to a sequence.

Get top referrer domains for a given period.

Get analytics summary: total views, unique visitors, top page, views today. Period: 7d, 30d, or 90d.

Get top pages by views for a given period.

Get daily views and visitors trend for a given period.

Append CSS to the end of the site's existing stylesheet without replacing it. Useful for adding new rules without re-sending the entire stylesheet.

Create up to 100 blog posts in a single request. Each post follows the same schema as thincms_create_post. Validation errors are reported per-item without failing the batch.

Get campaign performance statistics (sent, opens, clicks, unsubscribes).

Inspect the running MCP wrapper: version, count of registered tools, and the live tool list. Use to detect when your MCP host has cached a stale tool surface — if the count or list doesn't match what you expect for the current wrapper version, restart your host (Claude Desktop / Claude Code / VS Code) so it re-handshakes with the wrapper.

Clear the drift flag on a review after the editor has reconciled the edit (e.g. they're satisfied the new text is fine). Resets driftFlag to 'none' and clears driftNotes; if the review was held as drift_pending, that hold is also cleared (so a previously published review re-appears on the widget).

Create a new author profile with bio, avatar, and social links.

Create a campaign record in ThinCMS. This stores the email content; it does NOT push to the connected mail platform (e.g. ActiveCampaign) or deliver to recipients. Use thincms_send_campaign as the second step.

Create a new category. Optionally nest it under a parent category for hierarchy.

Create a new collection. Display modes: 'cards' (grid), 'carousel' (horizontal scroll), 'banner' (full-width rotating), 'list' (vertical stack), 'compact' (smaller grid). Embed with {{collection:slug}} in page frame or content.

Add an item to a collection. The 'body' field is required (main content, can be HTML). Other fields are optional and visibility depends on the collection's show* settings.

Create a new reusable content block. For type='html' (default) the content field holds raw HTML inserted wherever {{block:slug}} appears. For type='reviews-widget', the block renders the published Google reviews widget server-side with config options (maxReviews, displayMode, minRating, showDate, showAvatar). Edit once, updates everywhere.

Create a new course or community. Courses start as draft by default. Set courseType to 'community' for ongoing recording libraries (modules become topics, lessons become recordings, content sorts newest-first). Set accessMode to control enrollment: 'free' (open), 'invite' (admin enrolls learners), or 'purchase' (Stripe payment required).

Enroll a learner in a course. The user must already exist — specify by email or userId. This bypasses payment requirements, effectively creating a free/invite enrollment.

Create a new form or survey. Use renderMode 'fields' for standard forms (with field definitions) or 'html' for custom HTML surveys served at /s/:slug. Use preset 'contact' or 'newsletter' for pre-configured field sets. For large HTML content (>10KB), use htmlContentFile instead of htmlContent to pass a local file path.

Configure a new email platform integration (one per site). Platform: activecampaign, kit, mailchimp, gohighlevel.

Create a new lead magnet. A lead magnet is a downloadable resource offered in exchange for a form submission (e.g., newsletter signup).

Create a new lesson within a module. Content is raw HTML. Lessons are auto-ordered within their module. For large content (>10KB), use contentFile instead of content.

Create a new module within a course. Modules are auto-ordered by creation sequence.

Create a new static page. Content should be raw HTML. Use renderMode 'wrapped' for pages that use the site template, or 'standalone' for full custom HTML. For large content (>10KB), use contentFile instead of content to pass a local file path.

Create a new popup/CTA. Each popup is linked to an existing form (by formId) which handles the actual data collection. The popup provides the presentation container, trigger logic, and targeting rules. Display types: 'overlay' (centered modal), 'sticky-top'/'sticky-bottom' (fixed bars), 'slide-in' (bottom-right card). On mobile, overlay auto-downgrades to sticky-bottom to avoid Google's interstitial penalty.

Create a blog post. Content should be raw HTML. Tags are auto-created if they don't exist. For large content (>10KB), use contentFile instead of content. Posts with status="published" and a publishedAt in the past appear on the public site immediately; a future publishedAt is auto-scheduling — they appear when the timestamp passes (no worker required, the public site filters by date). Posts with status="draft" never appear publicly regardless of dates. Use scheduledFor="immediate" to publish now, or scheduledFor=<ISO timestamp at least 60 min in the future> to schedule.

Create a preview session with draft template or content overrides. Returns a token-based preview URL (valid for 2 hours). Use this to preview CSS/template changes or draft content without publishing.

Create a new quiz within a module. Quizzes share sort order with lessons — use thincms_reorder_module_items to position them. Two feedback modes: 'show_answer' reveals correct answers after submission, 'retry' shows only the score.

Create a URL redirect. Source path must start with /. Use /* suffix for wildcard matching.

Create a script injection for the public site. Scripts can be placed in the or before .

Create a new environment variable secret. The value is stored securely and never returned in API responses.

Create a new email sequence.

Create a new tag. Note: tags are also auto-created when included in the tags array of a post.

Create a new Tool. html is the raw HTML/JS payload that renders inside a sandboxed iframe with a window.thinCMS runtime injected. Set authRequired to 'password' | 'google' | 'either' to gate access; 'none' makes the tool public. Set systemPrompt to prepend a persona to /ai/chat calls. For large HTML payloads (>10KB), use htmlFile with a local file path.

Create a workbook inside a module. Workbooks are fillable forms that live alongside lessons and quizzes — use thincms_reorder_module_items to position them. The fields array defines the form spec. For large specs (>10KB), use fieldsFile instead.

Delete an author by ID. Posts by this author will have their author unset.

Delete a campaign.

Delete a category by ID. Posts in this category will be uncategorized.

Delete a collection and all its items. Any {{collection:slug}} references will render as empty.

Delete an item from a collection.

Delete a content block. Any {{block:slug}} references in templates or content will render as empty.

Delete a course and all its modules, lessons, quizzes, and enrollments.

Delete an enrollment permanently.

Delete a lead magnet by ID.

Delete a lesson and its attachments.

Delete a file attachment from a lesson.

Delete a media item and remove the file from disk.

Delete a module and all its lessons and quizzes.

Permanently delete a static page by ID.

Delete a popup by ID.

Permanently delete a blog post by ID.

Delete a quiz and all its questions and attempts.

Delete a question from a quiz.

Delete a redirect by ID.

Delete a sequence and all its steps.

Delete a step from a sequence.

Delete a form submission by ID.

Delete a subscriber by ID.

Delete a tag by ID. Removes the tag from all posts.

Permanently delete a Tool. Cascades to all ToolData rows, ToolAiUsage rows, and end-user sessions scoped to it.

Delete a single data key. Deletes only the caller's scope — with subscriberId, the per-user value; without, the tool-global value.

Delete a workbook and all its learner responses. This is destructive — there is no soft delete.

Export a learner's full course portfolio (every workbook in module order) as PDF or Markdown. Pass outputPath for PDF (required) or to save the Markdown to disk.

Export all submissions for a form as CSV data.

Export all subscribers as CSV data.

Export a single learner's workbook response as PDF or Markdown. Pass outputPath to write the file to disk (required for PDF; recommended for Markdown). Without outputPath, Markdown is returned inline.

Export every learner response for a workbook as CSV (admin). Pass outputPath to save to disk; otherwise the CSV body is returned inline.

Generate optimized WebP image variants for all images in the media library that don't have them yet. Creates thumbnail (400px), medium (800px), and large (1200px) WebP versions. Admin-only.

Get a campaign by ID.

Get a single collection by ID, including all its items.

Get a single content block by ID.

Get a single course by ID, including its modules, lessons, and quizzes.

Get a single form by ID with full field definitions and configuration.

Get the site's email platform integration configuration.

Get a single lead magnet by ID.

Get a single lesson by ID, including its attachments.

Get the download URL for a lesson attachment. Returns the URL path — append to your base URL to download.

Get a single media item by ID with full metadata. The response includes a variants field with optimized WebP versions (thumbnail 400px, medium 800px, large 1200px) when available.

Get the site's header and footer navigation arrays. Each nav item has a label, type (page/route/external), and target.

Get a single static page by ID, including full HTML content.

Get a single popup by ID with full configuration.

Get a single blog post by ID, including full HTML content, author, categories, and tags.

Get a signed preview URL for a blog post. Works for any status (draft, scheduled, future-dated, published). The URL is valid for 72 hours and requires no authentication to view. Use this after creating or updating a post to verify how it looks on the live site.

Get the full preview URL for a preview token. The URL can be opened in a browser to view the preview — no authentication required.

Get a single quiz by ID, including its questions with correct answers.

Get a single redirect by ID.

Get a single review by ID, including full text, sentiment fields, and drift notes if drift was detected.

Get the current reviews + AI configuration for the active site, plus recipient list and last-sync status. Admin-only. Secrets are echoed only as has*Key booleans, never as plaintext.

Get a sequence by ID, including its steps.

Get site settings: name, tagline, description, domain, logo URL, favicon URL, footer HTML, and widget configuration. Read-only via API key.

Get the site's share button configuration. Returns { enabled: boolean, platforms: string[] }. Platforms: 'twitter', 'linkedin', 'facebook', 'email', 'copy'.

Get the site's social media links. These render in the footer via the {{social:links}} template tag.

Get a single tag by ID, including associated posts.

Get the site's template: stylesheet (CSS), pageFrame (HTML wrapper with template tags like {{content}}, {{nav:header}}), and customHeadHtml.

Get a single Tool by ID or slug, including the full HTML payload and config.

Read a single Tool data value. If subscriberId is provided, prefers the per-user value at that scope; otherwise reads tool-global. Falls back to tool-global if no per-user value exists.

Get a workbook by ID. Returns the workbook with its full field spec (already JSON-parsed).

Take a site live by provisioning SSL for the production domain and transitioning from 'preview' to 'live' status. Requires the production domain's DNS to be pointed to the server first. This calls the go-live endpoint which provisions Nginx config + SSL certificate.

Bulk import redirects from a JSON array. Existing redirects with the same sourcePath are updated (upsert).

List all authors with their bios, avatars, and post counts.

List email campaigns with optional status filter and pagination.

List all categories with post counts and hierarchy information.

List all items in a collection, ordered by sortOrder.

List all collections for the site. Collections are structured data lists (testimonials, reviews, products, team members) that render via {{collection:slug}} template tag in multiple display modes: cards, carousel, banner, list, compact.

List all reusable content blocks for the site. Optional enabled filter. Content blocks are HTML fragments insertable via {{block:slug}} template tags in the page frame or page/post content.

List courses with optional filters. Returns courses with module/enrollment counts.

List course enrollments with optional filters. Returns enrollments with user and course details.

List all forms and surveys with submission counts.

List all mailing lists from the connected email platform.

List all tags from the connected email platform.

List all lead magnets for the site.

List uploaded media files with pagination. Returns file metadata including paths, dimensions, and alt text.

List static pages with optional status filter and pagination.

List all popups/CTAs for the site with their linked form names.

List blog posts with optional filters. Returns posts without content by default (use includeContent=true for full HTML). Supports pagination.

List all URL redirects. Optionally filter by enabled status.

List Google reviews ingested for the active site (Reviews Module v1). Filterable by post status, rating, sentiment, hold reason, and drift flag. Reviews are pulled from Outscraper on a daily cron schedule; sentiment is run via the configured AI provider. Use postStatus=posted to see what's currently on the public widget.

List all script injections (analytics, chat widgets, tracking pixels, etc.).

List environment variable secrets. Returns key names and descriptions only — values are never returned for security.

List email sequences (drip campaigns) with their steps.

List all configured ThinCMS sites with preview URLs and status (preview/live). Shows which site is currently active.

List all snapshots taken in the current MCP wrapper session. Useful for finding the right snapshotId to restore, or auditing what test writes have been made.

List form submissions with pagination. Returns submission data (field values) and timestamps.

List subscribers/members with optional search and pagination.

List all tags with post counts.

List all data keys visible to the caller — merges per-user (when subscriberId is supplied) with tool-global. Per-user values shadow global at the same key. Returns each key with its value, scope ('user' or 'global'), and updatedAt.

List end-user Subscribers who have interacted with a Tool (have data rows or AI usage on it), sorted by most-recent activity. Returns id, email, name, emailVerified, lastLoginAt, and lastActiveOnTool.

List publishable Tools (mini-apps) with optional status/enabled filters and pagination. Tools render at /tools/:slug and can be authenticated (Google or password), store per-user JSON data, and call AI via /ai/chat and /ai/complete.

List workbooks across the site, optionally filtered by course or module. Each result includes module info and a response count.

Replace a named section of the stylesheet between comment markers. The stylesheet must contain /* START: / and / END: */ markers. Only the content between these markers is replaced.

IMPORTANT — what to send: pass ONLY the body to insert between the markers, not a full stylesheet. If your input contains its own START: and END: markers matching the same section name, the API will auto-extract the body for you. If it contains markers for a DIFFERENT section, the call is rejected to prevent silent doubling. Use dryRun=true on large patches to verify the size delta before committing.

Pause a published sequence automation.

Mark a review as posted to the public reviews widget. Sets postStatus='posted' and clears any holdReason. Subject to the production-write guard if the site is in THINCMS_PRODUCTION_SITE_IDS — pass confirmProductionWrite=true to acknowledge.

Publish a sequence as an automation in the email platform.

Re-run sentiment analysis for a single review (id) or all reviews on the site (all=true). Useful after switching the AI provider in Settings. Does NOT change postStatus — only sentiment fields. Admin-only.

Bulk reorder items in a collection. Pass an array of { id, sortOrder } pairs.

Reorder lessons, quizzes, and workbooks within a module. All three types share a single sort order space — pass all items in the desired order with their type.

Reorder modules within a course. Pass all module IDs in the desired order.

Reorder steps in a sequence.

Write a previously-captured snapshot back to its original resource. Reverts the resource to the exact bytes captured at snapshot time. Fails if the snapshot has expired (24h) or the resource has been deleted. Use as the cleanup step after any test write.

Full-text search across published posts and pages. Searches titles, excerpts, and content.

Push the campaign to the connected mail platform (e.g. ActiveCampaign) and request delivery. If scheduledFor is "immediate" (or the legacy scheduledAt is empty), the platform begins sending right away. If scheduledFor is a future timestamp (or scheduledAt is set), the platform queues it for that time. Returns success when the platform accepts the queue request — actual recipient delivery is asynchronous and reported via thincms_campaign_stats. Optionally pass scheduledFor here to override the stored schedule in the same call. WARNING — the platform locks the schedule at first send. To reschedule a campaign you have already sent, delete it and recreate it; a /send with a changed schedule against an already-queued campaign returns 409.

Send (or re-send) the email-verification email to a subscriber. Generates a fresh 24-hour verify token, invalidating any prior pending token. Rejected if the subscriber's email is already verified.

Analyze a single post or page for SEO signals. Returns word count, heading structure, image count (with missing alt detection), internal/external link counts, meta field lengths, and actionable suggestions.

Run an SEO audit across all published posts and pages. Reports missing meta descriptions, missing meta titles, title length issues, missing OG images, thin content, missing excerpts, and duplicate titles. Returns a summary with score and a list of issues per item.

Scan published content for broken links. By default checks internal links only (fast). Set checkExternal=true to also verify external URLs via HEAD requests (slower, limited to 50 URLs). Optionally scope to a single post or page by providing type and id.

Set free-text editor notes on a review (internal-only; not shown publicly). Useful for tracking why something was unpublished or what to do about a flagged drift event.

Set a password for a subscriber. Admin action for bulk-provisioning end-users of Tools (mini-apps); skips the signup email flow. Password must meet strength rules (8+ chars, upper, lower, digit). Existing sessions for the subscriber are revoked so the new password takes effect everywhere.

Write a Tool data value. Without subscriberId, writes tool-global (visible to every user of the tool). With subscriberId, writes per-user data — the workhorse for AI agents updating a specific user's personalized dashboard, Kanban board, or state file. value accepts any JSON: object, array, string, number, boolean, or null.

Capture the current state of a site resource so it can be restored byte-for-byte later. Use BEFORE any test write against a customer site — restore returns the resource to the exact pre-test state regardless of what the test write does (null, substitute, partial update, etc.). Snapshots live in MCP wrapper memory for 24 hours; they survive across tool calls within a session but are lost on host restart. Supports scope='settings', 'template', 'page' (requires resourceId), 'post' (requires resourceId), and 'review' (requires resourceId).

Switch the active ThinCMS site. All subsequent API calls will use this site's credentials.

Bulk sync all subscribers to the email platform. Creates tags for lead magnets and pushes all subscribers.

Manually trigger a reviews poll for the active site (same code path the cron uses). Fetches from the configured provider, runs sentiment on new reviews, applies the auto-post rule, and detects drift. Subject to the production-write guard. Optional backfillDaysOverride lets you re-run with a longer history window.

Get the current template's stats (hash, byte size, line count) for each field. Optionally compare against local files to verify a push landed correctly. Returns match/mismatch with size and line differences.

Round-trip a 1-token prompt to the configured AI provider to confirm the key + model combination works. Returns provider, model, and a tiny sample reply. Admin-only.

Test the email platform connection.

Hide a review from the public widget. Sets postStatus='not_posted' and holdReason='editor_unpublished'. Subject to the production-write guard.

Update an existing author profile. Only provided fields are changed.

Update a draft or scheduled campaign.

Update an existing category. Only provided fields are changed.

Update collection settings. Supports partial updates.

Update a collection item. Supports partial updates.

Update an existing content block. Supports partial updates — only include fields you want to change.

Update an existing course. Only provided fields are changed (partial update).

Update an enrollment status. Use to approve pending enrollments or revoke access.

Update an existing form or survey. Only provided fields are changed. For large HTML content (>10KB), use htmlContentFile instead of htmlContent.

Update the email platform integration config.

Update an existing lead magnet. Supports partial updates.

Update an existing lesson. Only provided fields are changed (partial update). For large content (>10KB), use contentFile.

Update media metadata (alt text, caption, visibility). Does not change the file itself.

Update a module's title or description.

Update header and/or footer navigation. Each is a full replacement array (max 20 items). Item types: 'page' (target = page slug, must exist and be published), 'route' (target = CMS path like /blog or /search), 'external' (target = full URL).

Update an existing static page. Only provided fields are changed (partial update). Content should be raw HTML. For large content (>10KB), use contentFile instead of content. Changing slug auto-creates a 301 redirect from the old URL.

Update an existing popup. Only provided fields are changed.

Update an existing blog post. Only provided fields are changed (partial update). Content should be raw HTML. For large content (>10KB), use contentFile instead of content. Changing slug auto-creates a 301 redirect from the old URL.

Update a quiz. Only provided fields are changed.

Update a quiz question. Only provided fields are changed.

Update an existing redirect. Only provided fields are changed.

Update reviews module + AI provider configuration. Partial-update — only provided fields change. Pass an empty string to a key field (e.g. reviews.outscraperApiKey='') to clear that secret. Admin-only; subject to production-write guard.

Update an existing script injection. Only provided fields are changed.

Update a sequence's name or trigger form.

Update a sequence step.

Update site settings. Supports partial updates — only provided fields are changed. Sensitive fields (SMTP, Stripe keys, API keys, billing) remain admin-only.

Update the site's share button configuration. Share buttons appear on blog posts and let readers share via social platforms or copy the link. Only provided fields are changed.

Replace the site's social media links (max 20). Each link needs a platform and URL. Supported platforms: linkedin, twitter, youtube, facebook, instagram, tiktok, github, email, website, custom. Use {{social:links}} in the page frame template to render them.

Update a tag's name, slug, or description.

Update the site's template. Only provided fields are changed. The pageFrame must contain {{content}} if provided. For large files (>10KB), use the File variants instead of inlining content. Available template tags: {{content}}, {{nav:header}}, {{nav:footer}}, {{site:name}}, {{site:tagline}}, {{site:logo}}, {{year}}, {{search:form}}.

Update an existing Tool. Only supplied fields change. For large HTML payloads (>10KB), use htmlFile instead of html.

Update a workbook (partial — only provided fields change). If fields is provided and differs from the current spec, the workbook's version is incremented and any removed-field values in existing responses are archived (not deleted).

Upload a file attachment to a lesson. Provide a local file path, a URL to download from, or base64-encoded content.

Upload an image or file to the media library. Provide exactly one source: filePath (local file), url (download from URL), or base64 (encoded content with filename). For images, optimized WebP variants (thumbnail 400px, medium 800px, large 1200px) are automatically generated and returned in the variants field.