ZORAWEBDESIGN SEO • WEB DESIGN • BRANDING
DE
DE Skip to documentation
CARE CMSDOCUMENTATION
Back to Care CMS

Developers

Published content API

Read published website content from a separate frontend without administrator credentials.

English onlyReviewed 2 November 2026
On this page

Endpoints

http
GET /api/v1/pages?locale=en-AT
GET /api/v1/pages?locale=de-AT&path=/services/
GET /api/v1/pages?locale=en-AT&limit=20&offset=0
GET /api/v1/modules

Both resources accept GET and OPTIONS. This is a public delivery API, not a content-management write API. It intentionally exposes published, non-trashed content only, never account records, email addresses, appointment details or authentication tokens.

Query parameters

ParameterValues
localede-AT or en-AT; defaults to en-AT
pathOptional exact public content path
limitInteger 1–100; defaults to 100
offsetInteger 0–10000; defaults to 0

Invalid locale or pagination bounds return HTTP 400. Follow pagination.nextOffset until it is null. Pages are ordered by path. An active starter limits the result to that site's published content and normalises its public aliases.

Example response

The following is illustrative; paths and content depend on the active website.

json
{
  "version": "1",
  "items": [{
    "path": "/en/services/",
    "type": "page",
    "locale": "en-AT",
    "translationKey": "example-services",
    "title": "Our services",
    "description": "An introduction to our fictional practice.",
    "html": "<p>Example published content.</p>",
    "updatedAt": "2026-11-02T09:00:00+01:00"
  }],
  "pagination": {"limit": 20, "offset": 0, "returned": 1, "nextOffset": null}
}

CORS and caching

Configure API_ALLOWED_ORIGIN with the exact external frontend origin. Matching browser GET/OPTIONS requests receive CORS headers; credentials are never enabled. CORS is browser policy, not protection against reading public content from a server client. Content responses declare a 60-second public cache lifetime and vary by Origin. The module catalogue declares 300 seconds. Do not apply this public caching policy to private drafts or administration responses.

What is not exposed

There is no public POST/PATCH/DELETE authoring API, taxonomy API, appointment feed or API-key provisioning screen. Authenticated editor endpoints are internal UI contracts, not stable public integration endpoints.

Something unclear? Contact me about this guide.