REST API

The public REST API is off by default. Enable it from the admin UI to expose read-only endpoints with no auth. There are no create / update / delete endpoints for posts or pages — the only write surface is the comment submit endpoint, which is gated by the same flag.

Enable

Admin → Settings → Public REST API. The same flag also gates POST /api/comments — ADR-005 collapsed both under one toggle.

Endpoints

GET /api/posts                # published posts (limit/offset)
GET /api/posts/:slug          # one post + approved comments
GET /api/pages/:slug          # one page
POST /api/comments            # comment submit (rate limited)

Sample response

{
  "posts": [
    {
      "id": 1,
      "slug": "hello",
      "title": "Hello",
      "excerpt": "...",
      "publishedAt": "2026-01-01T00:00:00.000Z",
      "thumbnail": {
        "mediaId": 12,
        "url": "https://your-site.example/media/12",
        "mime": "image/png",
        "width": 1280,
        "height": 720
      },
      "terms": [{ "id": 3, "taxonomy": "category", "slug": "news", "name": "News" }]
    }
  ]
}

Auth and rate limiting

The public API requires no auth. The comment endpoint applies a per-IP token bucket (capacity 5, refill 0.1/sec). Read endpoints have no built-in rate limiter — if you need one, layer it at the reverse proxy (nginx limit_req or similar).