The public API

The public API lets your own scripts and build tools work with your workspace: list your sites and their pages, read deployments and domains, read and export form submissions, and publish. It is version 1, at https://api.xeek.be/v1. The full reference, every operation with its parameters and answers, is the OpenAPI document at https://api.xeek.be/v1/openapi.json, which most API tools can open.

API tokens

Every call needs an API token, sent as a header: Authorization: Bearer xs_api_…. An owner or admin of the workspace creates a token, chooses what it may do (its scopes), whether it works for the whole workspace or one site, and when it expires, at most a year later. The token is shown once; keep it like a password. It can be revoked at any time.

A token acts as the member who created it, limited to its scopes. If that member's role changes, the token can do less from its next call; if they leave the workspace, it stops working.

Scope	What it allows
sites:read	Read sites, pages, deployments and domains
publish:preview	Publish to staging
publish:production	Publish to your live site
forms:read	Read and export form submissions

Form submissions hold your visitors' personal data, so only a token with forms:read reads them, and every read and export appears in the workspace's audit log.

Requests and answers

• Reads are GET requests; publishing is a POST with a JSON body.
• Lists come a page at a time. Ask for up to 100 items with limit (50 when you leave it out). When there are more, the answer's nextCursor is not null: send it back as cursor for the next page.
• A publish needs an Idempotency-Key header with a new UUID. If your script sends the same request again with the same key, for example after a timeout, it gets the first answer back instead of a second publish.
• An error answers with an HTTP status and a JSON body: error.code (such as FORBIDDEN or NOT_FOUND), a message in the language of your Accept-Language header, and a requestId to quote when you contact support.

Limits

Each token may make 600 reads and 120 writes a minute, and each site may be published 20 times an hour. Past a limit the answer is 429 RATE_LIMITED with a Retry-After header that says how many seconds to wait.

Versions

Within version 1 the API only grows: new operations and new fields, never a removed field or a new required one. Write your scripts to ignore fields and values they don't know. A change that would break a script comes as version 2, next to version 1.