Server API

createCMS returns an api object namespaced by collection and by system feature. You call cms.api.<collection>.<method> for content (e.g. cms.api.pages.createRoot) and cms.api.<namespace>.<method> for system features (e.g. cms.api.media.uploadAssets). Inputs and outputs are fully typed from your collection definitions.

const { roots } = await cms.api.pages.listRoots({ query: { limit: 20 } });

Every method follows the better-call convention: read methods take a query object, write methods take a body object. Every commit-producing mutation returns a commit: { id, message, createdAt, createdBy } envelope, the new branch head. The same methods are available on the client as client.<collection>.<method>, with identical types.

Permissions

Every endpoint runs an authorization check keyed by a resource and an operation (create, read, update, or delete), shown on each method as a resource:operation chip (for example root:create). Access control maps those to your roles. The only endpoint reachable without a session is the public media gate media.asset; the anonymous-readable reads (getPublishedContent, resolveRedirect, and the A/B resolveAbVariant) still run the auth chain under the publishedContent resource, so plugin scope is enforced.

Collection methods

Available on every collection as cms.api.<collection>.<method>.

System namespaces

Feature APIs, each on its own cms.api.<namespace>.