RenewCMS is headless: it stores your content and your own code displays it. There are two ways in. Public read-only access lets a website read online articles. API keys let a script or service manage articles, media and users, and manage content types and entries, without the back-office.

Authentication

PublicNo key

No key needed. Two read-only routes, and only online articles are returned.

GET /v1/article/GET /v1/article/{id}

API keyFull access

Send Authorization: Bearer rcms_…. Requests act as the user who created the key, with that user's role as it is now. A key never has more rights than its creator. A route that needs a permission answers 403 "missing_permission" to a key whose creator's role lacks it. Keys start with rcms_ and are shown in full once, when you create them. Manage API keys

A key can't create, list or revoke API keys, log in, register, verify or reset a password, or call anything under /v1/system. Those routes answer 403 "This action needs a real session." An invalid, unknown, expired or revoked key answers 401, even on public routes, and so does a key whose user was deleted or unverified. Owner and admin routes answer 403 to a key whose creator is neither.

Each key can make 120 requests per minute. Beyond that the API answers 429 with a Retry-After header.

{{ g.title }}

{{ g.count }}

{{ g.desc }}

{{ p.t }}{{ p.t }}

Field types

TypeValue in an entryRules

{{ r.t }}{{ p.t }}{{ p.t }}{{ p.t }}{{ p.t }}

{{ ep.m }}{{ ep.p }} {{ ep.d }} {{ c.t }}

{{ ep.bodyTitle }}

NameTypeRequiredRule

{{ f.n }}{{ f.t }}{{ f.req }}{{ f.rule }}

No request body.

Errors

{{ e.c }}{{ e.cap }}{{ e.cap }}{{ e.tail }}

Session only

{{ sessCount }}

These routes need a signed-in browser session. With an API key they answer 403 "This action needs a real session."

{{ sg.t }}

{{ r.m }}{{ r.p }}{{ r.d }}Session only

Errors

Every error is a plain-text body with a single sentence. The status code is in the HTTP status line, and the Content-Type is text/plain.

StatusMeaningTypical cause

{{ r.c }}{{ r.m }}{{ p.t }}{{ p.t }}{{ r.n }}

Notes

Images in body use paths like /static/uploadedImages/<uuid>.png. Prefix them with the base URL before rendering.

Browsers can only call the API from origins listed in the server's CORS setting. Ask whoever runs the server to add your site's address.

Article routes accept ?format=markdown, ?format=html or ?format=json to choose how body is returned. With json, body is the stored JSON structure. Articles have body_format: markdown by default.