API reference

Public non-API routes

Route	Description
`GET /` and all other paths	Rendered pages of the website for the requested domain. Unknown paths: `404`, rendered with the website’s 404 page (`notfound_page_id`, otherwise a published page with slug `404` directly below the home page, otherwise a default page). Without any website, every path returns the default 404
`GET /…?_site=<id>`	For logged-in admins, if the domain is not assigned to any website: shows the website `<id>` and remembers the choice via the cookie `ic_site`
`GET /…?preview=1`	For logged-in admins: also shows unpublished pages and entries
`GET /robots.txt`	robots.txt of the website for the requested domain (`robots_txt` or automatically “allow everything”), with a `Sitemap:` line; without a website, only `User-agent: *` / `Allow: /`
`GET /favicon.ico`	The website icon (`favicon_file_id`) of the website for the requested domain with its own content type, cacheable for 1 day; without an icon `404`
`GET /healthz`	Health check for monitoring and load balancers, without login. `200` with `{"status":"ok","version":"v0.1.9","db":"ok","build":"3137badfea7f","commit":"0659464c7ce2","uptime_s":42,"headless":false}`; if the database doesn’t respond, `503` with `"status":"error"`. `build` = ID of the admin app (like the `X-IC-Build` header), `commit` = Git commit of the binary (empty if unknown; `-dirty` for uncommitted changes). With `hide_version`, only `{"status":"ok","db":"ok"}` without login. Never cached
`GET /media/{path}`	Uploaded files. `…/bild.jpg.webp` returns the WebP version of a JPEG/PNG (generated on first request); `?w=500` the smallest variant at least 500 px wide, `?format=webp` the WebP version (combinable). Otherwise: (`Cache-Control: max-age=86400` plus `Last-Modified`, no directory listings; SVGs with a restrictive CSP). With `Access-Control-Allow-Origin: `, so that web fonts also load from other domains and in the admin preview. Private files* (original, variants, WebP) only with an admin session, an API token (header or `?token=`, read-only tokens included) or a valid signature `?exp=…&sig=…` (`POST /files/{id}/signed-url`), otherwise `404` as for missing files; then `Cache-Control: private, no-store`, `X-Robots-Tag: noindex`, `Referrer-Policy: no-referrer`, no download statistics
`GET /sitemap.xml`	Automatically generated sitemap of the website for the requested domain: all published pages except those with `sitemap_exclude` or `noindex` and the 404 page (without a website: empty sitemap) (subpages of drafts are included). Domain and scheme come from the request or `X-Forwarded-Host`/`-Proto`. Detail pages behind catch-all pages are included: automatically for collections that the template reads via `item("coll", "feld", route.slug)`, otherwise from the page’s `sitemap_source` (IllusionDB, workflow; cached for 10 minutes, if the source fails, the last state is kept). With more than 50,000 addresses, `/sitemap.xml` is a sitemap index pointing to `/sitemap-1.xml`, `/sitemap-2.xml`, … – linked language versions (pages and catch-all entries) get an `<xhtml:link rel="alternate" hreflang>` per version (namespace `xmlns:xhtml`)
`GET /_assets/css/{id}.css?v={ts}`	CSS asset, minified with esbuild (license comments are kept; unchanged on syntax errors). If `v` matches `updated_at`, it is cached `immutable` for one year, otherwise `no-cache`. Like `/media`, with `Access-Control-Allow-Origin: *`
`GET /_assets/js/{id}.js?v={ts}`	JS asset, as above
`GET /cms-admin/`	Admin app
`GET /cms-admin/pen/{uuid}`	Pen: when logged in, the editor (admin app), otherwise – for public pens only – result and code for reading (`?view=1` shows admins this view). Always `X-Robots-Tag: noindex, nofollow`; anonymous requests count towards the rate limit
`GET /cms-admin/pen/{uuid}/result`	Rendered result of a pen, with `Content-Security-Policy: sandbox …` (separate origin)