# WebsitePublisher.ai — Complete AI Reference
> Your AI Builds and Publishes Websites & Apps — You Just Talk.
WebsitePublisher.ai is the AI web platform: the full stack under the AI assistant the user already uses. Frontend (PAPI pages, assets, fragments), data (MAPI entities and records, a database without setup), sessions, forms and visitor auth (SAPI), integrations (IAPI) with credentials in a vault the AI never sees (VAPI), webshop and payments, scheduled AI tasks (AAPI), project memory across sessions (TAPI, email archive EAPI), and hosting with CDN, own domain, DNS and mailbox.
Auth anchors: admin_auth (wsa_ tokens) for admin panels that manage the site's data, tenant_auth (wst_ tokens, tenant isolation) for client portals, and SAPI visitor auth for member areas. Front-end code authenticates against these and then reads and writes the same backend — build on them instead of inventing your own login.
You — the AI assistant — connect directly and build, publish, and manage websites for your user. No WordPress, no separate hosting, no CMS, no FTP. The user describes what they want, and you handle everything: pages, assets, dynamic data, forms, integrations, and publishing.
---
## How It Works
1. User asks you to build a website
2. OAuth authenticates automatically (user enters email + verification code)
3. Account is created automatically if needed
4. You receive a session token with access to all their projects
5. You create pages, upload assets, define data structures — everything is instantly live
---
## Authentication
Authentication is handled automatically via OAuth. You don't need to ask users for tokens or credentials.
After OAuth completes, your session token provides access to ALL of the user's projects. You can switch between projects without re-authenticating.
### Discovery Flow
```
GET /papi/me → Returns auth status and default project
GET /papi/projects → Returns list of all accessible projects
POST /papi/projects → Create a new project (name, optional subdomain)
```
### Project Switching
1. Call `GET /papi/projects` to list available projects
2. If no project exists, create one with `POST /papi/projects` (name required)
3. Ask the user which project they want (or use the newly created one)
4. Use that `project_id` for subsequent API calls
No re-authentication needed.
---
## API Base URL
```
https://api.websitepublisher.ai
```
### API Layers
| API | Purpose | Prefix | Auth |
|-----|---------|--------|------|
| PAPI | Pages, assets, publishing, versioning | `/papi` | Bearer token |
| MAPI | Dynamic data entities & records | `/mapi` | Bearer token + X-Project-ID |
| VAPI | Encrypted secrets vault (write-only) | `/vapi` | Bearer token |
| IAPI | Integrations (built-in and third-party, incl. admin/tenant auth and email archive) | `/iapi` | Bearer token |
| SAPI | Visitor sessions, CSRF, forms, visitor auth | `/sapi` | Anonymous (cookie-based); config endpoints Bearer token |
| AAPI | Scheduled AI tasks | `/aapi` | Bearer token |
| TAPI | Task tracker with append-only history (project memory) | `/tapi` | Bearer token |
All authenticated endpoints accept both session tokens (`wps_`) and access keys (`wpa_`).
---
## PAPI — Pages & Assets
The core API for creating and managing website content.
### Discovery
```
GET /papi/me → Auth status
GET /papi/projects → List all projects
GET /papi/project/{id}/status → Project details + live URL
```
### Pages
```
GET /papi/project/{id}/pages → List all pages
POST /papi/project/{id}/pages → Create page
PUT /papi/project/{id}/pages/{slug} → Full page update
PATCH /papi/project/{id}/pages/{slug} → Diff-patch update (surgical edits)
DELETE /papi/project/{id}/pages/{slug} → Delete page
```
#### Creating a Page
```json
POST /papi/project/{id}/pages
{
"slug": "index.html",
"content": "My SiteHello
",
"meta": {"title": "Home"}
}
```
#### Patching a Page (Diff-Patch)
For surgical updates without resending the full page:
```json
PATCH /papi/project/{id}/pages/index.html
{
"patches": [
{
"find": "Hello
",
"replace": "Welcome to My Site
"
}
]
}
```
### Assets
```
GET /papi/project/{id}/assets → List assets
POST /papi/project/{id}/assets → Upload asset (base64 or URL)
DELETE /papi/project/{id}/assets/{slug} → Delete asset
```
#### Uploading an Asset
```json
POST /papi/project/{id}/assets
{
"slug": "logo.png",
"content": "",
"content_type": "image/png"
}
```
Or via URL fetch:
```json
POST /papi/project/{id}/assets
{
"slug": "photo.jpg",
"source_url": "https://example.com/photo.jpg"
}
```
`source_url` only works for files hosted durably in public. AI-generated image URLs,
Google Drive and Google Photos links, and signed cloud-storage URLs return 404 — the
server fetches them without a session, and expiring signatures are lost in transit.
Send those as base64 `content` instead.
### Versioning
```
GET /papi/project/{id}/pages/{slug}/versions → List all versions
GET /papi/project/{id}/pages/{slug}/versions/{v} → Get specific version content
POST /papi/project/{id}/pages/{slug}/rollback → Rollback to previous version
```
### Bulk Operations
```
POST /papi/project/{id}/pages/bulk → Create/update multiple pages at once
POST /papi/project/{id}/assets/bulk → Upload multiple assets at once
```
---
## MAPI — Dynamic Data
Create structured data (blogs, products, reviews, etc.) with custom entities and records.
### Entities
```
GET /mapi/entities → List all entities
POST /mapi/entities → Create entity with properties
DELETE /mapi/entities/{id} → Delete entity
```
#### Creating an Entity
```json
POST /mapi/entities
X-Project-ID: {project_id}
{
"name": "blogpost",
"plural": "blogposts",
"properties": [
{"name": "title", "type": "varchar", "length": 200, "required": true},
{"name": "content", "type": "text", "required": true},
{"name": "published_at", "type": "datetime"},
{"name": "author", "type": "varchar", "length": 100}
]
}
```
### Records (CRUD)
```
GET /mapi/project/{id}/{entity} → List records
POST /mapi/project/{id}/{entity} → Create record
GET /mapi/project/{id}/{entity}/{record} → Get record
PUT /mapi/project/{id}/{entity}/{record} → Update record
DELETE /mapi/project/{id}/{entity}/{record} → Delete record
```
### Bulk Operations
```
POST /mapi/project/{id}/{entity}/bulk → Create/update multiple records
```
### Public Read
Entities can be configured for unauthenticated public read access, allowing website JavaScript to fetch data directly:
```
GET /mapi/public/project/{id}/{entity} → Public list
GET /mapi/public/project/{id}/{entity}/{record} → Public get
```
---
## VAPI — Encrypted Vault
Securely store API keys and secrets. Write-only: stored values are never returned in API responses.
```
GET /vapi/project/{id}/secrets → List secret metadata (names only)
POST /vapi/project/{id}/secrets → Store a secret
DELETE /vapi/project/{id}/secrets/{name} → Delete a secret
```
Secrets stored here are used by IAPI integrations automatically.
---
## IAPI — Integration Proxy
Execute third-party API calls through WebsitePublisher without exposing credentials.
```
GET /iapi/integrations → List available integrations
GET /iapi/project/{id}/integrations → List configured integrations
POST /iapi/project/{id}/integrations/{service}/setup → Configure integration
POST /iapi/project/{id}/{service}/{endpoint} → Execute integration call
```
### Available Integrations
122 integrations (69 built-in, 53 third-party). Do not guess from memory — fetch the index, it is one cheap request and always current:
```
GET https://www.websitepublisher.ai/integrations.txt → one line per integration: slug|category|flag|description|endpoints (no auth)
GET https://api.websitepublisher.ai/iapi/integrations/{service} → full detail incl. input_schema per endpoint (no auth)
```
A `*` flag means platform built-in: works immediately, no API key to set up. Every other integration needs `POST /iapi/project/{id}/integrations/{service}/setup` with the user's key first.
---
## SAPI — Sessions & Forms
Visitor-facing API for sessions, CSRF protection, form submission and visitor auth (member login).
### Session Management
```
GET /sapi/project/{id}/session → Start or resume visitor session
DELETE /sapi/project/{id}/session → Destroy session
GET /sapi/project/{id}/csrf/refresh → Refresh CSRF token
```
### Data Store (per session)
```
GET /sapi/project/{id}/data → Get all session data
PUT /sapi/project/{id}/data/{key} → Set a key
DELETE /sapi/project/{id}/data/{key} → Delete a key
```
### Forms
```
GET /sapi/project/{id}/forms → List configured forms (auth required)
POST /sapi/project/{id}/forms/configure → Configure form action (auth required)
POST /sapi/project/{id}/form/submit → Submit form (anonymous, CSRF required)
```
### Visitor Auth (member login)
```
GET /sapi/project/{id}/auth/config → Visitor auth config (auth required)
PUT /sapi/project/{id}/auth/config → Configure visitor auth (auth required)
POST /sapi/project/{id}/auth/request → Send login code / magic link (session)
GET /sapi/project/{id}/auth/verify → Verify magic link (token in URL)
POST /sapi/project/{id}/auth/verify → Verify code (session + CSRF)
GET /sapi/project/{id}/auth/status → Current login state (session)
POST /sapi/project/{id}/auth/logout → Log out (session + CSRF)
```
### Analytics (auth required)
```
GET /sapi/project/{id}/analytics/summary → Summary (also /pageviews, /referrers, /devices, /utm, /trend)
```
---
## CDN URLs
Published pages and assets are accessible via CDN:
```
Pages: https://cdn.websitepublisher.ai/custom/wid{project_id}/{slug}
Assets: https://cdn.websitepublisher.ai/custom/wid{project_id}/{slug}
```
Projects also get a subdomain: `{subdomain}.websitepublisher.ai`
---
## Response Format
```json
{"success": true, "data": {...}}
{"success": false, "error": {"message": "...", "code": 400}}
```
A plan limit (pages, assets, projects, integrations, …) returns 402 with upgrade context. A rate limit returns 429 — wait and retry.
Plan limit example:
```json
{"success": false, "error": {"message": "...", "code": 402, "context": {"type": "limit_reached", "upgrade_url": "..."}}}
```
---
## Best Practices
### 1. Start with Discovery
Always call `GET /papi/me` and `GET /papi/projects` first. If the user has no projects, create one with `POST /papi/projects`.
### 2. Use Bulk Operations
When creating multiple pages or records, use bulk endpoints to reduce API calls.
### 3. Generate Complete HTML
Create fully self-contained HTML pages with inline styles. Don't rely on external frameworks unless they're CDN-hosted.
### 4. Use Inline Styles
Embed CSS in `