REST API Overview

The Profound CMS REST API is served by the Rust translation_manager service. It exposes headless read/stream endpoints used by the renderer, plus write endpoints for content, translation, and CSV import.

All examples use {CMS_API_URL} as the base URL of your CMS API host (for example https://cms.dev.tryprofound.com). There is no global path prefix — routes are mounted at the root, e.g. {CMS_API_URL}/routes.

Authentication

The API uses two separate schemes depending on the endpoint.

API key (headless reads + variant upsert)

Send the key as the x-api-key header or the api_key query parameter:

curl '{CMS_API_URL}/dataset/post?websiteId=<uuid>' \
  -H 'x-api-key: <your-api-key>'

Keys are validated against WorkOS and cached briefly in memory. For read endpoints, an API key is only required when the server sets require_schema_api_key = true; otherwise anonymous reads are allowed. The variant upsert (PATCH /dataset/{schema_name}) always requires a valid key carrying the content_write permission.

Uses API-key auth: /routes, /route, /blocks*, /components*, /dataset/*, /schemas/*, /content-changes.

Bearer JWT (WorkOS)

Management endpoints require a WorkOS user JWT:

curl '{CMS_API_URL}/usage?orgId=<uuid>' \
  -H 'Authorization: Bearer <workos-jwt>'

Uses Bearer auth: /translation, /translations, /usage, /csv.

Resolving the website (tenant)

API-key endpoints resolve the target website in this order:

1. The ?websiteId=<uuid> query parameter
2. The Host header, matched against a configured website domain
3. The CMS_WEBSITE_ID fallback (single-tenant / local dev)

If none resolves to a valid UUID, the endpoint returns 400.

Error model

Health check

GET {CMS_API_URL}/health returns { "status": "ok" } and needs no authentication — use it for liveness probes.