List blog posts with optional filters. Returns posts without content by default (use includeContent=true for full HTML). Supports pagination.

Get a single blog post by ID, including full HTML content, author, categories, and tags.

Create a blog post. Content should be raw HTML. Tags are auto-created if they don't exist. For large content (>10KB), use contentFile instead of content. Posts with status="published" and a publishedAt in the past appear on the public site immediately; a future publishedAt is auto-scheduling — they appear when the timestamp passes (no worker required, the public site filters by date). Posts with status="draft" never appear publicly regardless of dates. Use scheduledFor="immediate" to publish now, or scheduledFor=<ISO timestamp at least 60 min in the future> to schedule.

Update an existing blog post. Only provided fields are changed (partial update). Content should be raw HTML. For large content (>10KB), use contentFile instead of content. Changing slug auto-creates a 301 redirect from the old URL.

Permanently delete a blog post by ID.

Get a signed preview URL for a blog post. Works for any status (draft, scheduled, future-dated, published). The URL is valid for 72 hours and requires no authentication to view. Use this after creating or updating a post to verify how it looks on the live site.

Create up to 100 blog posts in a single request. Each post follows the same schema as thincms_create_post. Validation errors are reported per-item without failing the batch.

List static pages with optional status filter and pagination.

Get a single static page by ID, including full HTML content.

Create a new static page. Content should be raw HTML. Use renderMode 'wrapped' for pages that use the site template, or 'standalone' for full custom HTML. For large content (>10KB), use contentFile instead of content to pass a local file path.

Update an existing static page. Only provided fields are changed (partial update). Content should be raw HTML. For large content (>10KB), use contentFile instead of content. Changing slug auto-creates a 301 redirect from the old URL.

Permanently delete a static page by ID.

List all categories with post counts and hierarchy information.

Create a new category. Optionally nest it under a parent category for hierarchy.

Update an existing category. Only provided fields are changed.

Delete a category by ID. Posts in this category will be uncategorized.

List all authors with their bios, avatars, and post counts.

Create a new author profile with bio, avatar, and social links.

Update an existing author profile. Only provided fields are changed.

Delete an author by ID. Posts by this author will have their author unset.

List all tags with post counts.

Create a new tag. Note: tags are also auto-created when included in the tags array of a post.

Get a single tag by ID, including associated posts.

Update a tag's name, slug, or description.

Delete a tag by ID. Removes the tag from all posts.

List uploaded media files with pagination. Returns file metadata including paths, dimensions, and alt text.

Get a single media item by ID with full metadata. The response includes a variants field with optimized WebP versions (thumbnail 400px, medium 800px, large 1200px) when available.

Upload an image or file to the media library. Provide exactly one source: filePath (local file), url (download from URL), or base64 (encoded content with filename). For images, optimized WebP variants (thumbnail 400px, medium 800px, large 1200px) are automatically generated and returned in the variants field.

Update media metadata (alt text, caption, visibility). Does not change the file itself.

Delete a media item and remove the file from disk.

Generate optimized WebP image variants for all images in the media library that don't have them yet. Creates thumbnail (400px), medium (800px), and large (1200px) WebP versions. Admin-only.

Get the site's template: stylesheet (CSS), pageFrame (HTML wrapper with template tags like {{content}}, {{nav:header}}), and customHeadHtml.

Update the site's template. Only provided fields are changed. The pageFrame must contain {{content}} if provided. For large files (>10KB), use the File variants instead of inlining content. Available template tags: {{content}}, {{nav:header}}, {{nav:footer}}, {{site:name}}, {{site:tagline}}, {{site:logo}}, {{year}}, {{search:form}}.

Get the current template's stats (hash, byte size, line count) for each field. Optionally compare against local files to verify a push landed correctly. Returns match/mismatch with size and line differences.

Append CSS to the end of the site's existing stylesheet without replacing it. Useful for adding new rules without re-sending the entire stylesheet.

Replace a named section of the stylesheet between comment markers. The stylesheet must contain /* START: / and / END: */ markers. Only the content between these markers is replaced.

IMPORTANT — what to send: pass ONLY the body to insert between the markers, not a full stylesheet. If your input contains its own START: and END: markers matching the same section name, the API will auto-extract the body for you. If it contains markers for a DIFFERENT section, the call is rejected to prevent silent doubling. Use dryRun=true on large patches to verify the size delta before committing.

Get the site's header and footer navigation arrays. Each nav item has a label, type (page/route/external), and target.

Update header and/or footer navigation. Each is a full replacement array (max 20 items). Item types: 'page' (target = page slug, must exist and be published), 'route' (target = CMS path like /blog or /search), 'external' (target = full URL).

Get site settings: name, tagline, description, domain, logo URL, favicon URL, footer HTML, and widget configuration. Read-only via API key.

Update site settings. Supports partial updates — only provided fields are changed. Sensitive fields (SMTP, Stripe keys, API keys, billing) remain admin-only.

List all script injections (analytics, chat widgets, tracking pixels, etc.).

Create a script injection for the public site. Scripts can be placed in the or before .

Update an existing script injection. Only provided fields are changed.

List environment variable secrets. Returns key names and descriptions only — values are never returned for security.

Create a new environment variable secret. The value is stored securely and never returned in API responses.

List all forms and surveys with submission counts.

Get a single form by ID with full field definitions and configuration.

Create a new form or survey. Use renderMode 'fields' for standard forms (with field definitions) or 'html' for custom HTML surveys served at /s/:slug. Use preset 'contact' or 'newsletter' for pre-configured field sets. For large HTML content (>10KB), use htmlContentFile instead of htmlContent to pass a local file path.

Update an existing form or survey. Only provided fields are changed. For large HTML content (>10KB), use htmlContentFile instead of htmlContent.

List form submissions with pagination. Returns submission data (field values) and timestamps.

Export all submissions for a form as CSV data.

Delete a form submission by ID.

Full-text search across published posts and pages. Searches titles, excerpts, and content.

Create a preview session with draft template or content overrides. Returns a token-based preview URL (valid for 2 hours). Use this to preview CSS/template changes or draft content without publishing.

Get the full preview URL for a preview token. The URL can be opened in a browser to view the preview — no authentication required.

Get the site's social media links. These render in the footer via the {{social:links}} template tag.

Replace the site's social media links (max 20). Each link needs a platform and URL. Supported platforms: linkedin, twitter, youtube, facebook, instagram, tiktok, github, email, website, custom. Use {{social:links}} in the page frame template to render them.

List all reusable content blocks for the site. Optional enabled filter. Content blocks are HTML fragments insertable via {{block:slug}} template tags in the page frame or page/post content.

Get a single content block by ID.

Create a new reusable content block. For type='html' (default) the content field holds raw HTML inserted wherever {{block:slug}} appears. For type='reviews-widget', the block renders the published Google reviews widget server-side with config options (maxReviews, displayMode, minRating, showDate, showAvatar). Edit once, updates everywhere.

Update an existing content block. Supports partial updates — only include fields you want to change.

Delete a content block. Any {{block:slug}} references in templates or content will render as empty.

List all collections for the site. Collections are structured data lists (testimonials, reviews, products, team members) that render via {{collection:slug}} template tag in multiple display modes: cards, carousel, banner, list, compact.

Get a single collection by ID, including all its items.

Create a new collection. Display modes: 'cards' (grid), 'carousel' (horizontal scroll), 'banner' (full-width rotating), 'list' (vertical stack), 'compact' (smaller grid). Embed with {{collection:slug}} in page frame or content.

Update collection settings. Supports partial updates.

Delete a collection and all its items. Any {{collection:slug}} references will render as empty.

List all items in a collection, ordered by sortOrder.

Add an item to a collection. The 'body' field is required (main content, can be HTML). Other fields are optional and visibility depends on the collection's show* settings.

Update a collection item. Supports partial updates.

Delete an item from a collection.

Bulk reorder items in a collection. Pass an array of { id, sortOrder } pairs.

List all popups/CTAs for the site with their linked form names.

Get a single popup by ID with full configuration.

Create a new popup/CTA. Each popup is linked to an existing form (by formId) which handles the actual data collection. The popup provides the presentation container, trigger logic, and targeting rules. Display types: 'overlay' (centered modal), 'sticky-top'/'sticky-bottom' (fixed bars), 'slide-in' (bottom-right card). On mobile, overlay auto-downgrades to sticky-bottom to avoid Google's interstitial penalty.

Update an existing popup. Only provided fields are changed.

Delete a popup by ID.

Get the site's share button configuration. Returns { enabled: boolean, platforms: string[] }. Platforms: 'twitter', 'linkedin', 'facebook', 'email', 'copy'.

Update the site's share button configuration. Share buttons appear on blog posts and let readers share via social platforms or copy the link. Only provided fields are changed.

List all URL redirects. Optionally filter by enabled status.

Get a single redirect by ID.

Create a URL redirect. Source path must start with /. Use /* suffix for wildcard matching.

Update an existing redirect. Only provided fields are changed.

Delete a redirect by ID.

Bulk import redirects from a JSON array. Existing redirects with the same sourcePath are updated (upsert).

Get analytics summary: total views, unique visitors, top page, views today. Period: 7d, 30d, or 90d.

Get top pages by views for a given period.

Get top referrer domains for a given period.

Get daily views and visitors trend for a given period.

List all configured ThinCMS sites with preview URLs and status (preview/live). Shows which site is currently active.

Switch the active ThinCMS site. All subsequent API calls will use this site's credentials.

Take a site live by provisioning SSL for the production domain and transitioning from 'preview' to 'live' status. Requires the production domain's DNS to be pointed to the server first. This calls the go-live endpoint which provisions Nginx config + SSL certificate.

Run an SEO audit across all published posts and pages. Reports missing meta descriptions, missing meta titles, title length issues, missing OG images, thin content, missing excerpts, and duplicate titles. Returns a summary with score and a list of issues per item.

Analyze a single post or page for SEO signals. Returns word count, heading structure, image count (with missing alt detection), internal/external link counts, meta field lengths, and actionable suggestions.

Scan published content for broken links. By default checks internal links only (fast). Set checkExternal=true to also verify external URLs via HEAD requests (slower, limited to 50 URLs). Optionally scope to a single post or page by providing type and id.

List courses with optional filters. Returns courses with module/enrollment counts.

Get a single course by ID, including its modules, lessons, and quizzes.

Create a new course or community. Courses start as draft by default. Set courseType to 'community' for ongoing recording libraries (modules become topics, lessons become recordings, content sorts newest-first). Set accessMode to control enrollment: 'free' (open), 'invite' (admin enrolls learners), or 'purchase' (Stripe payment required).

Update an existing course. Only provided fields are changed (partial update).

Delete a course and all its modules, lessons, quizzes, and enrollments.