Every space has an API

A space is not just a website — it’s a website with an API, and that API is its own. It lives at the space’s own address ({slug}.ctxr.app/api/), scoped to that one tenant. There is no shared, platform-wide API that reaches across spaces; each space answers only for itself. This is the same isolation that defines a space everywhere else (see What is a space), applied to its programmatic surface.

One surface, used by everyone

The editor, an external integration, and your own scripts all speak to the same API. There’s one entrypoint — a single endpoint where each request names the action it wants — so there is one place to authenticate, one place to rate-limit, and no sprawl of routes to discover. The site you see, the editor you work in, and the systems you connect are all talking to the same door.

Two ways in, no passwords

Who’s calling decides how they authenticate, but neither way is a password:

• People sign in with a one-time code sent by email, exchanged for a session token — the same login described in Editing content.
• Systems use a key you mint for them: a long bearer token, shown once, carrying an explicit set of permissions. A read-only key can read everything and change nothing.

Either way the caller resolves to an actor with a permission set, and every action is checked against it. The full model — the nine rights, presets and how sign-in works — is Access & permissions. The platform doesn’t care who or what is calling — a person, a second account, a script — only what capability they hold. That capability-over-identity stance is one of the platform’s core principles.

Where the details live

This page is the concept — that the API exists, belongs to the space, and is reached one way by people and another by systems. Two other places carry the specifics, kept apart on purpose so they stay easy to maintain:

• The API in the Development chapter — the technical shape: the request body, the auth flows, JSON-LD output.
• API actions in Reference — the catalogue: every action, what it does, and the permission it needs.

Keeping the actual action list in one reference table — rather than scattering it through the narrative — is what keeps it accurate as the platform grows.