# Peerfold — full agent knowledge

> Everything an AI coding agent needs to build on Peerfold — the API, the auth flows, the SDKs, the recipes, and the rules that keep you out of trouble.

Everything an agent needs to build against Peerfold, in one file: what the platform is, how to connect, which authentication flow to choose, the resource map, the recipes, the content model, the guardrails, and a generated index of every API operation.

## What Peerfold is

Peerfold is a hosted learning platform. A workspace (a *tenant*) holds courses, learners, enrollments, progress, quizzes and exams, certificates, memberships and orders. It ships a learner portal of its own at `your-workspace.peerfold.app`, and it exposes the same data over a public HTTP API so you can build any surface you want on top of it: a catalog page on a marketing site, a fully custom course player, an internal dashboard, an onboarding flow inside your product.

You are almost certainly here to do one of three things. **Configure** — change branding, courses or settings, which an agent can do over MCP without writing code. **Embed** — drop Peerfold widgets into a site you already own. **Go headless** — own the frontend end to end and call the API for everything. This kit covers all three, and is most useful for the third.

Two facts shape most design decisions. First, **published courses are immutable revisions** — a learner always reads the revision that was published, so editing a draft never changes what someone is part-way through. Second, **the API is generated from one OpenAPI 3.1 contract**, which also generates the route validation, the client types and the MCP tool schemas — so if the docs and the API disagree, that is a bug, not a nuance.

## Connecting your agent

If your tool speaks **MCP**, connect it and use its tenant-scoped tools to author courses, enroll learners, read reports, and discover and try endpoints, with no curl commands to write. **An AI assistant needs no key.** Claude and ChatGPT both take the server URL `https://app.peerfold.com/api/mcp` as a custom connector and nothing else: a browser opens, you approve the workspace, and that is the whole setup. Nothing is typed into a file, so nothing can leak out of one.

```bash
claude mcp add peerfold https://app.peerfold.com/api/mcp
```

Cursor and other MCP clients take the same endpoint — `https://app.peerfold.com/api/mcp`, transport **Streamable HTTP** — in their own MCP config, and OAuth the same way. Each connection is revocable on its own under **Settings → Developers → Connected AI assistants**.

A **secret key** is for a programmatic client with no browser to redirect through — a script, a backend service, a CI job. Present it as a bearer header:

```bash
claude mcp add --transport http peerfold https://app.peerfold.com/api/mcp \
  --header "Authorization: Bearer sk_live_…"
```

Tools that do not support MCP use the HTTP API directly; everything below works the same way for them.

### Without MCP: a key and a base URL

Create a key pair in the workspace under **Settings → Developers**. You get a publishable key (`pk_live_…`, browser-safe) and a secret key (`sk_live_…`, shown exactly once, server-side only). Then:

| Plane | Base URL | Credential |
| --- | --- | --- |
| Learner (browser) | `https://your-workspace.peerfold.app` | Short-lived learner JWT (15 min) |
| Admin / server | `https://app.peerfold.com` | Secret key `sk_live_…` |

```bash
# Admin plane — server-side only.
curl https://app.peerfold.com/api/v1/lms/learners \
  -H "Authorization: Bearer $PEERFOLD_SECRET_KEY" \
  -H "Peerfold-Version: 2026-07-01"
```

Pin the API version with the `Peerfold-Version` header. Responses carry `X-Request-Id` and rate-limit headers; errors are RFC 7807 `application/problem+json` with a stable machine-readable `code`.

### The SDKs

`@peerfold/api-client` is a typed, zero-runtime-dependency wrapper over `fetch` (browser, Node and edge). `@peerfold/react` adds a provider and hooks. `@peerfold/js` is a prebuilt browser bundle exposing `window.Peerfold` for script-tag use, plus the embeddable cart drawer. Types in the client are inferred from the same schemas that validate the live API, so a contract change breaks your build rather than your users.

```ts
import { PeerfoldClient } from "@peerfold/api-client";

// Browser / learner plane.
const client = new PeerfoldClient({
  baseUrl: "https://your-workspace.peerfold.app",
  learnerToken: () => tokenStore.get(), // string or a provider fn
});

// Server / admin plane — NEVER construct this in browser code.
const admin = new PeerfoldClient({
  baseUrl: "https://app.peerfold.com",
  secretKey: process.env.PEERFOLD_SECRET_KEY,
});
```

## Choosing an auth model

This is the decision people get wrong, and it is expensive to undo. Learner-plane calls need a **learner JWT** (15 minutes, tenant-scoped, one learner). The flows differ only in how that JWT is obtained.

| Use this | When | Secret lives |
| --- | --- | --- |
| **Admin secret key** | Server-to-server only: reporting, bulk enrollment, provisioning, back-office jobs. No end user involved. | Your server |
| **Learner PKCE** | You own a frontend and want Peerfold to handle sign-in. Default choice for a headless portal or SPA. | Nowhere — no secret in the browser |
| **Trusted relay (token exchange)** | Your app already authenticated the person and you want to hand them straight in, no second login. | Your server / serverless function |
| **Membership assertion** | A HubSpot CMS page whose visitor is already a logged-in member. Zero-login hand-off, rendered server-side. | The CMS theme's settings (digest only) |

### Admin secret key

`Authorization: Bearer sk_live_…` against `https://app.peerfold.com`. It is the whole workspace, so it never touches a browser, a client bundle, or a committed file. It can also mint a learner token directly (`POST /api/v1/auth/learner-token` with `email` or `member_id`) — that is the trusted-subsystem shortcut, and it means anyone holding the key can act as any learner.

### Learner PKCE (the default for your own frontend)

1. Register your redirect URI under **Settings → Developers** (it is an allowlist; unregistered URIs are rejected).
2. Send the browser to `GET https://your-workspace.peerfold.app/api/v1/auth/authorize` with `client_id` (your publishable key), `redirect_uri`, `code_challenge` (S256) and `state`. Peerfold renders its own login page — email + login code.
3. On success it redirects back with `code`; exchange it at `POST https://your-workspace.peerfold.app/api/v1/auth/token` with your `code_verifier`.
4. You get an access token (15 min) and a refresh token. Refresh at the same endpoint with `grant_type=refresh_token`; refresh tokens rotate on use.

No secret key is involved anywhere in this flow, which is exactly why it is the default: a leaked artifact leaks nothing.

### Trusted relay

If your own app already knows who the user is, put a small server endpoint in front of `POST /api/v1/auth/token-exchange` (secret-key authed). It asserts the signed-in user server-side and returns a learner token to the browser; the browser never sees the key. `@peerfold/js` has this wired — `createPeerfold({ relayUrl })` re-mints through your relay whenever the token expires.

```js
const { client, refresh } = Peerfold.createPeerfold({
  baseUrl: "https://your-workspace.peerfold.app",
  relayUrl: "/api/peerfold-token", // your endpoint; it holds the secret key
});
await refresh();
const catalog = await client.catalog.list();
```

### Membership assertion (HubSpot CMS)

A HubSpot CMS page cannot call an API at render time, so the theme instead renders a signed assertion for the logged-in member and the browser trades it for a learner token at `POST /api/v1/auth/membership-assertion`. The payload is `portalId|contactVid|email|tsSeconds` and the signature is `md5(secret + "|" + payload)` as lowercase hex — md5 because HubL exposes exactly one hash filter. The signing secret lives in theme settings and only its digest is ever rendered; assertions are emitted only inside the logged-in branch, and they are short-lived.

There is also a lead-gen pair for anonymous visitors — `POST /api/v1/auth/leadgen-identify` resolves a HubSpot tracking cookie to a known contact, and `POST /api/v1/auth/leadgen-send` emails them a login code. Use it to turn "we already know this person" into a one-click sign-in, never as an authentication decision on its own.

## The resource map

| Area | Plane | What you get |
| --- | --- | --- |
| Identity | Learner | `GET/PATCH /api/v1/me` — the signed-in learner's profile. |
| Catalog & courses | Learner | `GET /api/v1/lms/catalog` (cursor-paginated), `GET /api/v1/lms/courses/{slug}` for the published revision with its chapters, lessons and block content. |
| Enrollment & progress | Learner | `GET/POST /api/v1/lms/enrollments`, `POST /api/v1/lms/enrollments/{id}/progress`, `GET /api/v1/lms/progress`. |
| Assessment | Learner | `POST …/quiz-attempts` and `POST …/exam-attempts` — both graded server-side. Answers are never scored in the browser. |
| Certificates | Learner + public | `GET /api/v1/lms/certificates`; `GET /api/v1/lms/certificates/verify/{serial}` is public, for a verification page. |
| Cart & checkout | Publishable key | `/api/v1/lms/cart/*` — create, read, add/remove, checkout. Anonymous; no learner session needed. |
| Learner admin | Secret key | `/api/v1/lms/learners*` — list, create, update, enroll, read certificates; `DELETE /api/v1/lms/enrollments/{id}` revokes. |
| Reporting | Secret key | `/api/v1/lms/reports/courses`, `…/courses/{id}/completion`, `/api/v1/lms/progress/export` (CSV or JSON). |
| Exams & credits | Secret key | `/api/v1/lms/lessons/{id}/exam` and its `…/questions`; `/api/v1/lms/ceu-types`, `/api/v1/lms/courses/{id}/ceus`. |
| Keys & webhooks | Secret key | `/api/v1/keys*`, `/api/v1/webhooks*` including deliveries and redelivery. |

Platform routes (`/api/v1/me`, `/api/v1/auth/*`, keys, webhooks) are product-neutral; LMS resources sit under `/api/v1/lms/*`. Lists are **cursor-paginated** — pass the `next_cursor` you were given, or let the SDK's `iterate()` walk it. The full, generated endpoint index is in `llms-full.txt`; the live contract is at `https://app.peerfold.com/api/v1/openapi.json`.

## Golden paths

### A catalog page

The catalog is learner-scoped: it returns what *this* learner is allowed to see, so gated and members-only courses appear correctly without you filtering anything.

```tsx
import { useCatalog } from "@peerfold/react";

export function Catalog() {
  const { data: courses, loading, error, reload } = useCatalog();
  if (loading) return <Spinner />;
  if (error) return <Retry message={error.message} onRetry={reload} />;
  return (
    <ul>
      {courses!.map((c) => (
        <li key={c.id}>
          <a href={`/courses/${c.slug}`}>{c.title}</a>
        </li>
      ))}
    </ul>
  );
}
```

Without React, the same call is `client.catalog.list({ limit: 25 })` for one page or `for await (const course of client.catalog.iterate())` for all of them.

### A course player

Fetch the course by slug, render its blocks, and record progress as the learner moves. Progress writes are **idempotent** — the client generates an `Idempotency-Key` per event unless you supply one, so a retry replays the stored response instead of double-counting.

```ts
const course = await client.courses.get(slug);
// course.chapters[].lessons[].blocks — see the block model below.

const enrollment = await client.enrollments.create({ course_slug: slug });

await client.progress.record(enrollment.id, {
  event_id: crypto.randomUUID(),
  type: "lesson_completed",
  lesson_id: lessonId,
});
```

In React, use `useProgressMutation` instead of calling `record` directly: it is optimistic, coalesces repeated events for the same lesson, keeps a stable idempotency key per queued item, and retries 429s and 5xxs with backoff. For the end of a visit, `Peerfold.progressBeacon(...)` writes with `fetch(keepalive)` so the last event survives the page unloading.

### Launching a SCORM package

SCORM packages run inside a Peerfold-hosted player, because the runtime needs same-origin access to the package contents and the CMI data model. You do not implement it — you frame it. From a HubSpot CMS page the launcher takes the membership assertion you already have:

```text
GET https://your-workspace.peerfold.app/api/portal/embed/scorm
  ?client_id=pk_live_…
  &payload=<urlencoded portalId|contactVid|email|tsSeconds>
  &sig=<lowercase hex md5(secret|payload)>
  &course=<course-slug>&lesson=<lesson-slug>
→ 303 https://your-workspace.peerfold.app/embed/<course>/<lesson>   (session cookie set)
```

Put that URL in an iframe and let the redirect happen inside the frame. Failures render a small human-readable page rather than JSON, because a person is looking at the frame; the usual fix is a reload, since the parent page re-signs a fresh assertion on every render. In a headless app where the learner already has a session, link to the same `/embed/{course}/{lesson}` path instead.

### Quizzes and exams

Both are graded server-side and both return the outcome. Never grade in the browser: the correct answers are not in the payload you rendered, and that is deliberate.

```ts
const quiz = await client.quizzes.submit(enrollment.id, {
  lesson_id: lessonId,
  block_id: "q1",
  answers: { "question-1": ["a"] },
});
// → { passed, score, … }

const exam = await client.exams.submit(enrollment.id, {
  lesson_id: examLessonId,
  answers: { /* question id → answer ids, or text for open questions */ },
});
```

An exam with open-ended questions comes back pending until a human grades it in the admin UI; the `exam.graded` webhook fires when it resolves. Certificates issue automatically when a course's completion rules are met — you do not create them.

A graded question may carry `answer_feedback`: coaching the author wrote for individual answer choices, already filtered by the server to the ones the learner may see. Draw each entry under its question, marked Correct or Incorrect from its `correct` field and named by that answer's text, then draw the question's `explanation`. `quizReviewRows` in `@peerfold/api-client` returns exactly that order. The text is HTML-lite, so sanitize it before it reaches the page.

### Checkout hand-off

Selling from your own site does not require a learner session. Build an anonymous cart with the publishable key, then hand off to Stripe Checkout and let Peerfold handle the return, the order and the enrollment.

```ts
// 1. Create a cart (returns a cart token — keep it in the browser).
// 2. POST /api/v1/lms/cart/items to add or remove a course.
// 3. POST /api/v1/lms/cart/checkout with your return URL.
//    → a Stripe Checkout URL; redirect the browser to it.
```

The drop-in alternative is the cart drawer from `@peerfold/js`: a `<script>` tag with `data-key="pk_live_…"` and `data-peerfold-add-to-cart="COURSE_ID"` on your buttons. Either way, your site's origin and return URL must be on the workspace's allowlist (**Settings → Developers**), or the call is rejected.

### Reacting to completions: webhooks, not polling

Register a webhook endpoint and subscribe to what you care about: `learner.enrolled`, `progress.lesson_completed`, `exam.submitted`, `exam.graded`, `certificate.issued`, `course.published`, `sync.dead_letter`.

Verify every delivery. The `X-Peerfold-Signature` header is `t=<unix seconds>,v1=<hex>` where the hex is HMAC-SHA256 of `"{t}.{raw body}"` under your endpoint's `whsec_…` secret. Compare in constant time, reject stale timestamps, and use the raw body — not a re-serialized object.

```ts
import crypto from "node:crypto";

function verify(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=") as [string, string]),
  );
  const expected = crypto
    .createHmac("sha256", secret)
    .update(parts.t + "." + rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}
```

Deliveries retry with exponential backoff for up to 24 hours, and an endpoint that fails persistently is disabled — so return 2xx fast and do the work asynchronously. If you genuinely cannot receive webhooks, the MCP `list_completions` tool is a keyset feed built for polling: call it with `limit`, persist `next_cursor`, resume from it next run, and stop when `caughtUp` is true.

## Peerfold Sites

Peerfold Sites is the page builder. Its API lives at `/api/v1/sites` because a site serves every product in the workspace. Sites, pages, publishing, themes, the registry and the whole delivery plane answer today. **The rest answers `503 not_configured` after its checks** (domains, the Full CMS structure, modules, forms, traffic, imports, assets): the contract is published ahead of the storage, so build against the shapes and treat that 503 as "not yet". A workspace without Sites gets 404 on every Sites path; a workspace whose Sites plan lapsed keeps serving the pages it already published.

| Plane | Paths | Credential |
| --- | --- | --- |
| Admin | `/api/v1/sites/*`: sites, domains, pages, publish, sitemap, chrome, registry, themes, modules, forms, analytics, imports, assets | Secret key (`PEERFOLD_SECRET_KEY`) or an OAuth access token. Server-side only. |
| Delivery | `/api/v1/sites/public/*`: `resolve`, `pages/by-path`, `pages/{pageId}`, `theme`, `manifest`, `sitemap`, `forms/{formId}/submit`, `events` | Publishable key; add a learner token for a signed-in visitor. Serves published revisions only; a draft needs a preview token from `POST …/pages/{pageId}/preview`. |

- **Two minimums per admin operation**, in the spec's `x-peerfold-sites` extension. `min_tier` is who is calling (`tenant`, `agency`, `internal`); a secret key is always `tenant`. `min_rung` is the Sites plan the workspace bought (1 Light, 2 More components, 3 More pages, 4 Full CMS). Below the tier is 404; below the plan is 403 `plan_required` with `reason: "sites_rung"`. Writing a theme (`PUT /api/v1/sites/themes/{themeKey}`) also asks the caller's role: only a connection approved by an owner, an admin or an agency partner may, and anyone else, a secret key included, gets 403 `forbidden` with `reason: "role"`.
- **Read `GET /api/v1/sites/registry` before writing a page.** It lists the components this plan may place with a JSON Schema for each, the page kinds and the components each requires, and the schema for one edit operation.
- **Pages change through one door**: `POST /api/v1/sites/{siteId}/pages/{pageId}/operations` with `base_version` and a batch of operations. All or nothing; a refusal lists every problem; a stale `base_version` is 409. `dry_run: true` checks without writing.
- **Nothing publishes as a side effect.** `POST …/pages/{pageId}/publish`, `POST /api/v1/sites/{siteId}/publish` or a `page.publish` operation does, and a revision is never edited afterward.
- **Cache the anonymous delivery reads.** They answer `public, s-maxage=60, stale-while-revalidate=300` with an `ETag`, and `If-None-Match` gets a 304. A read with a learner token is `private, no-store`. Bound values arrive in `resolved[nodeId][prop].value`, and course or program listings in `data[nodeId]`.
- **A node with `locked: true` is required by its page kind and can never be removed.** Draw it without a delete control and use `requiredModuleIsRemovable()` / `isRequiredNode()` from `@peerfold/api-client` instead of your own copy of the rule.

```ts
import { PeerfoldClient, isRequiredNode } from "@peerfold/api-client";

// Server side: the admin plane.
const admin = new PeerfoldClient({ baseUrl: "https://app.peerfold.com", secretKey: process.env.PEERFOLD_SECRET_KEY });
const registry = await admin.sites.getRegistry();
const page = await admin.sites.getPage(siteId, pageId);
await admin.sites.applyOperations(siteId, pageId, {
  base_version: page.version,
  operations: [/* shapes from registry.operations_schema */],
});

// A delivery server: the public plane.
const site = new PeerfoldClient({ baseUrl: "https://your-workspace.peerfold.app", publishableKey: "pk_live_…" });
const where = await site.sites.public.resolve(request.headers.get("host")!);
const served = await site.sites.public.getPage({ site_id: where.site_id, path: "/pricing" });
const deletable = !isRequiredNode(served.tree.root);
```

## Course content: the block model

A lesson body is an ordered array of blocks. A block is `{ type, props }`, plus `children` for the container types. The same registry drives the editor, the renderer, SCORM export and the authoring tools, so content written through the API renders identically to content written by hand.

The registry types are: `heading`, `richText`, `callout`, `file`, `resources`, `table`, `image`, `video`, `embed`, `audio`, `button`, `timer`, `quiz`, `process`, `flashcards`, `sorting`, `continue`, `discussion`, `interactive`, `form`, `accordion`, `columns`, `divider`.

**Do not guess a block's props.** Ask for the schema — over MCP, `list_block_types` gives you the catalog and `get_block_schema` gives one type's JSON Schema, default props and a ready-to-paste example node; the same content is served as the `peerfold://block-schema-reference.json` resource. Then `validate_blocks` before you write, and `update_lesson_blocks` to write (it REPLACES the whole lesson body, so read `get_lesson_blocks` first).

Block JSON served by the API is semver'd and additive-only within a major version. When you render it, **fall back gracefully on an unknown block type** rather than throwing — new block types are added without a major bump, and a player that crashes on one is a player that breaks on a Tuesday.

## Guardrails

### Build against a sandbox

In **Settings → Developers**, create a key pair with mode **Test**. The `sk_test_…` key resolves to a sandbox workspace with its own courses, learners and enrollments — seeded with demo data, excluded from CRM sync, transactional email, billing and metering. Nothing you do there can reach production data or send a real person an email. Develop there; switch the key when you ship.

### Never commit a key

Secret keys go in the environment (`PEERFOLD_SECRET_KEY`), never in a file that lands in a repository, a client bundle, or a prompt. Every key in this kit is a placeholder. If you need one, mint it in the workspace UI — a key is shown exactly once, and a key that leaks is revoked and replaced, not rotated later.

### Rate limits

120 requests/minute per key on Professional, 600 on Enterprise; the anonymous cart gets 60/minute. Every response carries the limit, remaining and reset. On a 429, back off and retry — the SDK surfaces `err.retryable` and `err.rateLimit` so you do not have to parse headers yourself.

### Write semantics that surprise people

- **Merge-patch vs. replace.** `set_course_settings` is a field-by-field merge patch: omitted fields keep their value, an explicit `null` clears one. `set_exam_questions`, `set_access_rules` and `set_course_ceus` REPLACE their entire list — read first, or you will delete what you did not send. `update_lesson_blocks` replaces the whole lesson body.
- **Unknown arguments are an error.** Inputs are strict: a misspelled field fails the call instead of being silently dropped. If a call fails on a field name, fix the name — do not retry with more fields.
- **Nothing publishes as a side effect.** `publish_course` is the only thing that publishes. If it finds structural problems it refuses once and tells you what they are; re-call with `confirm_issues: true` to publish anyway, deliberately.
- **Publishing is a revision.** Learners keep reading the previously published revision until the new one lands, so a half-finished edit is never visible.
- **Every write is audit-logged** and syncs to the connected CRM through the standard outbox — an API write and a UI edit are indistinguishable downstream.

### Two more habits

- **Grade nothing client-side.** Quiz and exam answers are scored on the server; the payload you render does not contain the correct answers, and it should not.
- **Log the request id.** Every response carries `X-Request-Id`, and errors carry it as `err.requestId`. Including it in your logs turns a support question into a lookup.

## Where to look things up

- **Full agent knowledge**: `https://app.peerfold.com/llms-full.txt` — this content plus a one-line index of every API endpoint.
- **Index**: `https://app.peerfold.com/llms.txt`.
- **OpenAPI 3.1 contract**: `https://app.peerfold.com/api/v1/openapi.json` — the source of truth; the docs, the SDK types, the route validation and the MCP tool schemas are all generated from it.
- **In-app developer docs**: `https://app.peerfold.com/help/dev` — API reference, webhooks, MCP, learner auth, personalized to your workspace.

- **Over MCP**: `list_api_endpoints` and `describe_endpoint` to browse the contract, `generate_client_snippet` for a call in your language, `try_endpoint` to run one against your sandbox.

## Every API endpoint

Generated from the OpenAPI 3.1 contract (version `2026-07-01`, 385 operations). Learner-token operations are called on the portal origin; secret-key operations on the admin origin.

```text
GET     /api/v1/me                                                           Current learner profile [learner token]
PATCH   /api/v1/me                                                           Update allowlisted profile fields [learner token]
GET     /api/v1/me/profile                                                   The member's own profile [learner token]
PATCH   /api/v1/me/profile                                                   Save the member's own details and photo [learner token]
PATCH   /api/v1/me/profile/fields                                            Answer the workspace's questions [learner token]
POST    /api/v1/me/avatar-uploads                                            An upload ticket for the member's photo [learner token]
GET     /api/v1/me/email-preferences                                         What the workspace emails the member about [learner token]
PATCH   /api/v1/me/email-preferences                                         Change what the workspace emails the member about [learner token]
GET     /api/v1/me/agent-connections                                         The AI agents the member connected [learner token]
DELETE  /api/v1/me/agent-connections/{id}                                    Disconnect an AI agent [learner token]
GET     /api/v1/me/notifications                                             The member's bell [learner token]
POST    /api/v1/me/push-subscriptions                                        Turn on browser notifications for this browser [learner token]
DELETE  /api/v1/me/push-subscriptions                                        Turn off browser notifications for this browser [learner token]
POST    /api/v1/me/notifications/read                                        Mark the member's notifications read [learner token]
GET     /api/v1/branding                                                     Academy branding (first-party app) [public]
POST    /api/v1/auth/learner-token                                           Mint a short-lived learner JWT (trusted subsystem) [secret key]
GET     /api/v1/auth/authorize                                               PKCE authorize — render the Cloud-hosted login page (Flow 2) [public]
POST    /api/v1/auth/login/request                                           Native JSON login — request a magic code (first-party app) [public]
POST    /api/v1/auth/login/verify                                            Native JSON login — verify a magic code (first-party app) [public]
POST    /api/v1/auth/token                                                   PKCE token endpoint — code exchange or refresh (Flow 2) [public]
POST    /api/v1/auth/revoke                                                  Sign out: revoke a refresh token and its family [public]
POST    /api/v1/auth/token-exchange                                          Serverless-relay trusted exchange (Flow 1, Enterprise) [secret key]
POST    /api/v1/auth/membership-assertion                                    Membership assertion — zero-login CMS learner auth [public]
POST    /api/v1/auth/leadgen-identify                                        Lead-gen identification — resolve a HubSpot tracking cookie to a known contact [public]
POST    /api/v1/auth/leadgen-send                                            Lead-gen send — email a login code to an identified contact [public]
POST    /api/v1/lms/cart/create                                              Create an anonymous cart [public]
GET     /api/v1/lms/cart/get                                                 Read the cart, priced live [public]
POST    /api/v1/lms/cart/items                                               Add or remove one course [public]
POST    /api/v1/lms/cart/checkout                                            Start Stripe Checkout for the whole cart [public]
GET     /api/v1/lms/catalog                                                  Published courses — for a learner, or for the public [learner token]
GET     /api/v1/lms/courses/{slug}                                           Course from the published revision — full, or public shell [learner token]
GET     /api/v1/lms/enrollments                                              The learner's enrollments [learner token]
POST    /api/v1/lms/enrollments                                              Enroll the authenticated learner [learner token]
POST    /api/v1/lms/enrollments/{id}/progress                                Append a progress event [learner token]
POST    /api/v1/lms/enrollments/{id}/heartbeats                              Report time on a lesson and video playback [learner token]
POST    /api/v1/lms/enrollments/{id}/quiz-attempts                           Submit a quiz attempt (graded server-side) [learner token]
POST    /api/v1/lms/enrollments/{id}/exam-attempts                           Submit a final-exam attempt (graded server-side) [learner token]
POST    /api/v1/lms/enrollments/{id}/interactive-launches                    Open an interactive experience [learner token]
GET     /api/v1/lms/interactive-launches/{id}                                What happened inside an interactive frame [learner token]
PATCH   /api/v1/lms/lessons/{id}                                             Set a lesson's thumbnail and estimated minutes [secret key]
GET     /api/v1/lms/lessons/{id}/forms                                       The forms on a lesson, resolved for this learner [learner token]
POST    /api/v1/lms/lessons/{id}/form-submissions                            Send a lesson form's answers [learner token]
GET     /api/v1/lms/lessons/{id}/discussion                                  A discussion lesson's conversation, for this learner [learner token]
POST    /api/v1/lms/lessons/{id}/discussion/replies                          Say something on a discussion lesson [learner token]
GET     /api/v1/lms/certificates                                             The learner's certificates [learner token]
GET     /api/v1/lms/certificates/verify/{serial}                             Public certificate verification (no auth) [public]
GET     /api/v1/lms/reports/feed/{token}.csv                                 Public report feed as CSV (no auth) [public]
GET     /api/v1/lms/progress                                                 Per-course progress summary (learner) [learner token]
GET     /api/v1/lms/resources                                                The tenant's resource library (learner) [learner token]
POST    /api/v1/lms/resources/import                                         Import links into the resource library [secret key]
POST    /api/v1/lms/resources/access                                         Set who may open several library resources [secret key]
GET     /api/v1/lms/resources/settings                                       The resource library's workspace settings [secret key]
PUT     /api/v1/lms/resources/settings                                       Set the resource library's default thumbnail [secret key]
PATCH   /api/v1/lms/resources/{id}                                           Update a library resource [secret key]
DELETE  /api/v1/lms/resources/{id}                                           Delete a library resource [secret key]
GET     /api/v1/keys                                                         List this tenant's active API keys [secret key]
POST    /api/v1/keys                                                         Create a key pair (secret shown once) [secret key]
DELETE  /api/v1/keys/{id}                                                    Revoke a key by id [secret key]
GET     /api/v1/cors-origins                                                 The workspace's browser-origin allowlist [secret key]
PUT     /api/v1/cors-origins                                                 Replace the browser-origin allowlist [secret key]
POST    /api/v1/connect/wordpress                                            Connect a WordPress site (origin + publishable key + capabilities + page map) [secret key]
POST    /api/v1/admin-embed/launch                                           Mint a one-time URL that frames the admin app [secret key]
GET     /api/v1/webhooks                                                     List webhook endpoints [secret key]
POST    /api/v1/webhooks                                                     Register a webhook endpoint (secret shown once) [secret key]
GET     /api/v1/webhooks/{id}                                                Get a webhook endpoint [secret key]
PATCH   /api/v1/webhooks/{id}                                                Update a webhook endpoint (url/events/status) [secret key]
DELETE  /api/v1/webhooks/{id}                                                Delete a webhook endpoint [secret key]
GET     /api/v1/webhooks/{id}/deliveries                                     Recent deliveries for an endpoint [secret key]
POST    /api/v1/webhooks/{id}/deliveries/{deliveryId}/redeliver              Re-queue a delivery for immediate re-send [secret key]
GET     /api/v1/admin/webhook-subscriptions                                  List this connection's subscriptions [OAuth token]
POST    /api/v1/admin/webhook-subscriptions                                  Subscribe to one event (secret shown once) [OAuth token]
DELETE  /api/v1/admin/webhook-subscriptions/{id}                             Unsubscribe [OAuth token]
GET     /api/v1/admin/webhook-subscriptions/sample/{event}                   A canned sample payload for one event [OAuth token]
GET     /api/v1/language                                                     The workspace default language and the languages learners can pick [secret key]
PATCH   /api/v1/language                                                     Set the workspace default language and the languages it offers [secret key]
GET     /api/v1/language/demand                                              What learners choose, and what their browsers ask for [secret key]
GET     /api/v1/language/custom                                              The workspace's custom language, its coverage and its seeding run [secret key]
PATCH   /api/v1/language/custom                                              Turn the custom language on, rename it, or make it the default [secret key]
PATCH   /api/v1/language/custom/labels                                       Edit the workspace's own wording, per label [secret key]
POST    /api/v1/language/custom/seed                                         Have Peerfold AI translate the portal into the custom language [secret key]
GET     /api/v1/language/custom-languages                                    Every custom language the workspace has [secret key]
POST    /api/v1/language/custom-languages                                    Add a custom language [secret key]
GET     /api/v1/language/custom-languages/{code}                             One custom language, its coverage and its seeding run [secret key]
PATCH   /api/v1/language/custom-languages/{code}                             Rename a custom language, change its code, or make it the default [secret key]
DELETE  /api/v1/language/custom-languages/{code}                             Remove a custom language and its labels [secret key]
PATCH   /api/v1/language/custom-languages/{code}/labels                      Edit one custom language's wording, per label [secret key]
POST    /api/v1/language/custom-languages/{code}/seed                        Have Peerfold AI translate the portal into one custom language [secret key]
GET     /api/v1/lms/learners                                                 List learners (saved-view filters + cursor) [secret key]
POST    /api/v1/lms/learners                                                 Create/invite a learner (find-or-create by email) [secret key]
GET     /api/v1/lms/learners/{id}                                            Get a learner [secret key]
PATCH   /api/v1/lms/learners/{id}                                            Update a learner's profile fields [secret key]
PUT     /api/v1/lms/learners/{id}/access                                     Turn a learner's academy access off, or back on [secret key]
GET     /api/v1/lms/learners/{id}/agent-connections                          The AI agents a learner connected to your sites [secret key]
DELETE  /api/v1/lms/learners/{id}/agent-connections/{connectionId}           Disconnect an AI agent from a learner's account [secret key]
GET     /api/v1/lms/learners/{id}/enrollments                                List a learner's enrollments [secret key]
POST    /api/v1/lms/learners/{id}/enrollments                                Enroll a learner in a course [secret key]
GET     /api/v1/lms/learners/{id}/certificates                               A learner's certificates [secret key]
POST    /api/v1/lms/completions/imports                                      Import historical completions and certificates [secret key]
POST    /api/v1/lms/completions/imports/preview                              Dry-run a completion import [secret key]
PATCH   /api/v1/lms/enrollments/{id}                                         Update an enrollment (deadline) [secret key]
DELETE  /api/v1/lms/enrollments/{id}                                         Revoke (delete) an enrollment [secret key]
GET     /api/v1/lms/lessons/{id}/exam                                        Get an exam's questions [secret key]
GET     /api/v1/lms/lessons/{id}/live-session                                The learner's view of a live lesson's session [learner token]
PUT     /api/v1/lms/lessons/{id}/exam/questions                              Replace an exam's questions [secret key]
GET     /api/v1/lms/exam-grades                                              List exam attempts to grade and recently graded [secret key]
GET     /api/v1/lms/enrollments/{id}/exam-attempts/{attempt_number}          Get one exam attempt for grading [secret key]
POST    /api/v1/lms/enrollments/{id}/exam-attempts/{attempt_number}/grade    Grade an exam attempt waiting for a manual grade [secret key]
POST    /api/v1/lms/enrollments/{id}/exam-attempts/{attempt_number}/regrade  Regrade a graded exam attempt [secret key]
GET     /api/v1/lms/certificates/{id}                                        Get a certificate — dual-plane by credential [secret key]
POST    /api/v1/lms/certificates/{id}/share                                  Mint a certificate's public share link [learner token]
DELETE  /api/v1/lms/certificates/{id}/share                                  Take a certificate's share link down [learner token]
GET     /api/v1/lms/progress/export                                          Export per-course progress (CSV or JSON) [secret key]
GET     /api/v1/lms/ceu-types                                                List the workspace's continuing-education credit types [secret key]
GET     /api/v1/lms/courses/{id}/ceus                                        The credits a course awards on completion [secret key]
PUT     /api/v1/lms/courses/{id}/ceus                                        Replace the credits a course awards [secret key]
GET     /api/v1/lms/courses/{id}/landing                                     A course's landing-page sections [secret key]
PUT     /api/v1/lms/courses/{id}/landing                                     Replace a course's landing page [secret key]
GET     /api/v1/lms/programs                                                 List learning pathways and certificate programs [secret key]
POST    /api/v1/lms/programs                                                 Create a program [secret key]
GET     /api/v1/lms/programs/{id}                                            One program in full [secret key]
PATCH   /api/v1/lms/programs/{id}                                            Update a program [secret key]
POST    /api/v1/lms/programs/{id}/checkout                                   Start checkout for a whole program [public]
GET     /api/v1/lms/courses/{id}/credit-reporting                            The member's credit reporting for one course [learner token]
POST    /api/v1/lms/courses/{id}/credit-reporting                            Give permission to report the member's credit [learner token]
DELETE  /api/v1/lms/courses/{id}/credit-reporting                            Stop reporting the member's credit [learner token]
GET     /api/v1/lms/memberships                                              The member's own memberships [learner token]
POST    /api/v1/lms/memberships/{id}/switch                                  Move the member's plan onto another tier [learner token]
POST    /api/v1/lms/memberships/billing-portal                               Open the member's billing account [learner token]
POST    /api/v1/lms/memberships/tiers/{id}/checkout                          Join a membership tier as the signed-in member [learner token]
GET     /api/v1/lms/memberships/tiers                                        The membership tiers on offer [public]
POST    /api/v1/lms/memberships/tiers/{id}/join                              Join a membership tier [public]
GET     /api/v1/lms/orders/{id}/status                                       Has this order been paid? [public]
PUT     /api/v1/lms/programs/{id}/courses                                    Replace a program's courses [secret key]
GET     /api/v1/lms/programs/{id}/landing                                    A program's landing-page sections [secret key]
PUT     /api/v1/lms/programs/{id}/landing                                    Replace a program's landing page [secret key]
POST    /api/v1/lms/programs/{id}/enrollments                                Enroll a learner in a program [secret key]
POST    /api/v1/lms/live-sessions/{id}/registrations                         Take a seat on a live session — dual-plane by credential [secret key]
DELETE  /api/v1/lms/live-sessions/{id}/registrations                         Give up the learner's own seat [learner token]
POST    /api/v1/lms/live-sessions/{id}/checkin                               The learner's own "I attended" [learner token]
GET     /api/v1/lms/live-sessions/{id}/ics                                   Add-to-calendar file for a live session [learner token]
GET     /api/v1/lms/reports/courses                                          Course summary stats [secret key]
GET     /api/v1/lms/reports/courses/{id}/completion                          Per-course learner completion [secret key]
GET     /api/v1/community/cohorts                                            Cohorts this member may see [learner token]
POST    /api/v1/community/cohorts                                            Create a cohort [secret key]
GET     /api/v1/community/cohorts/{slug}                                     One cohort [learner token]
PATCH   /api/v1/community/cohorts/{slug}                                     Change a cohort [secret key]
DELETE  /api/v1/community/cohorts/{slug}                                     Delete an empty cohort [secret key]
PUT     /api/v1/community/cohorts/{slug}/active                              Archive or restore a cohort [secret key]
PUT     /api/v1/community/cohort-order                                       Arrange the cohort directory [secret key]
POST    /api/v1/community/cohorts/{slug}/members                             Add a member to a cohort [secret key]
PATCH   /api/v1/community/cohorts/{slug}/members/{memberId}                  Set a member's role in a cohort [secret key]
DELETE  /api/v1/community/cohorts/{slug}/members/{memberId}                  Remove a member from a cohort [secret key]
PUT     /api/v1/community/roster/{memberId}/role                             Set a member's workspace community role [secret key]
PATCH   /api/v1/community/roster/{memberId}/allowances                       Give one member more or less than the workspace default [secret key]
PATCH   /api/v1/community/reports/{id}                                       Resolve or reopen an abuse report [secret key]
GET     /api/v1/community/settings                                           Read the community's workspace defaults [secret key]
PATCH   /api/v1/community/settings                                           Change the community's workspace defaults [secret key]
GET     /api/v1/community/terminology                                        Read the workspace's own nouns [secret key]
PATCH   /api/v1/community/terminology                                        Rename the workspace's nouns [secret key]
PATCH   /api/v1/community/badges/{badge}                                     Rename or re-skin a badge [secret key]
DELETE  /api/v1/community/badges/{badge}                                     Delete a badge from the catalog [secret key]
POST    /api/v1/community/badges/{badge}/awards                              Award a badge by hand [secret key]
DELETE  /api/v1/community/badges/{badge}/awards/{memberId}                   Take a badge back [secret key]
GET     /api/v1/community/cohorts/{slug}/threads                             A cohort's threads [learner token]
GET     /api/v1/community/cohorts/{slug}/ideas                               A board's ideas [learner token]
POST    /api/v1/community/ideas/{id}/votes                                   Upvote an idea [learner token]
DELETE  /api/v1/community/ideas/{id}/votes                                   Take a vote back [learner token]
PATCH   /api/v1/community/ideas/{id}/status                                  Move an idea along the board [learner token]
POST    /api/v1/community/cohorts/{slug}/membership                          Join a cohort [learner token]
DELETE  /api/v1/community/cohorts/{slug}/membership                          Leave a cohort [learner token]
GET     /api/v1/community/cohorts/{slug}/access-rules                        A cohort's access rules [secret key]
PUT     /api/v1/community/cohorts/{slug}/access-rules                        Replace a cohort's access rules [secret key]
POST    /api/v1/community/threads                                            Start a thread [learner token]
GET     /api/v1/community/threads/{ref}                                      One thread with its comments [learner token]
PATCH   /api/v1/community/threads/{ref}                                      Edit a thread [learner token]
PATCH   /api/v1/community/posts/{id}                                         Edit a comment [learner token]
DELETE  /api/v1/community/posts/{id}                                         Delete a post [learner token]
PATCH   /api/v1/community/posts/{id}/flags                                   Pin a thread, mark a solution [learner token]
PATCH   /api/v1/community/posts/{id}/moderation                              Hide a post, or put it back [learner token]
GET     /api/v1/community/search                                             Search discussions [learner token]
POST    /api/v1/community/threads/{ref}/comments                             Comment on a thread [learner token]
POST    /api/v1/community/threads/{ref}/follow                               Follow a thread [learner token]
DELETE  /api/v1/community/threads/{ref}/follow                               Unfollow a thread [learner token]
POST    /api/v1/community/posts/{id}/reactions                               React to a post [learner token]
DELETE  /api/v1/community/posts/{id}/reactions                               Remove a reaction [learner token]
POST    /api/v1/community/posts/{id}/poll-votes                              Vote in a thread's poll [learner token]
GET     /api/v1/community/feed                                               The member's feed [learner token]
GET     /api/v1/community/members                                            The member directory [learner token]
GET     /api/v1/community/badges                                             The achievement-badge catalog [learner token]
POST    /api/v1/community/badges                                             Add a badge to the catalog [secret key]
GET     /api/v1/community/members/{username}                                 A member's public profile [learner token]
POST    /api/v1/community/members/{username}/follow                          Follow a member [learner token]
DELETE  /api/v1/community/members/{username}/follow                          Unfollow a member [learner token]
GET     /api/v1/community/profile                                            The caller's own community profile [learner token]
PATCH   /api/v1/community/profile                                            Update the caller's community profile [learner token]
POST    /api/v1/community/reports                                            File an abuse report [learner token]
GET     /api/v1/community/notifications                                      The caller's notifications [learner token]
POST    /api/v1/community/notifications/read                                 Mark notifications read [learner token]
GET     /api/v1/prm/me                                                       Who the caller is in the partner program [learner token]
PATCH   /api/v1/prm/me                                                       Edit the caller's own partner profile [learner token]
GET     /api/v1/prm/me/email-preferences                                     Which of the program's mails the caller wants [learner token]
PATCH   /api/v1/prm/me/email-preferences                                     Change the caller's mail switches [learner token]
GET     /api/v1/prm/leads                                                    The caller's registered leads [learner token]
POST    /api/v1/prm/leads                                                    Register a lead [learner token]
GET     /api/v1/prm/leads/{id}                                               One of the caller's leads [learner token]
POST    /api/v1/prm/leads/{id}/release                                       Give one of the caller's leads back to the pool [learner token]
GET     /api/v1/prm/deals                                                    The caller's deals [learner token]
GET     /api/v1/prm/deals/{id}                                               One of the caller's deals [learner token]
PATCH   /api/v1/prm/deals/{id}                                               Edit what a partner owns on a deal [learner token]
POST    /api/v1/prm/deals/{id}/proposed-amount                               Propose what the deal is worth [learner token]
GET     /api/v1/prm/deals/{id}/room                                          The Deal Room on one of the caller's deals [learner token]
POST    /api/v1/prm/deals/{id}/room/messages                                 Write in the Deal Room [learner token]
POST    /api/v1/prm/deals/{id}/room/read                                     Mark the Deal Room read [learner token]
GET     /api/v1/prm/commissions                                              The caller's statement [learner token]
GET     /api/v1/prm/referral-links                                           The caller's referral links [learner token]
POST    /api/v1/prm/referral-links                                           Make a named referral link [learner token]
DELETE  /api/v1/prm/referral-links/{id}                                      Retire one of the caller's referral links [learner token]
GET     /api/v1/prm/mdf-requests                                             The caller's funding requests [learner token]
POST    /api/v1/prm/mdf-requests                                             Ask the program to fund a campaign [learner token]
GET     /api/v1/prm/mdf-requests/{id}                                        One of the caller's funding requests [learner token]
GET     /api/v1/prm/agreements                                               What the program has asked the caller to sign [learner token]
GET     /api/v1/prm/agreements/{id}                                          One agreement, with the document to sign [learner token]
POST    /api/v1/prm/agreements/{id}/viewed                                   Record that the caller opened it [learner token]
POST    /api/v1/prm/agreements/{id}/signature                                Sign an agreement [learner token]
POST    /api/v1/prm/agreements/{id}/decline                                  Decline an agreement [learner token]
GET     /api/v1/prm/attributions                                             The caller's referral touches [learner token]
GET     /api/v1/prm/program/partners                                         The partner roster [secret key]
GET     /api/v1/prm/program/partners/{id}                                    One partner [secret key]
PATCH   /api/v1/prm/program/partners/{id}                                    Update a partner [secret key]
PATCH   /api/v1/prm/program/leads/{id}                                       Move a lead through review [secret key]
POST    /api/v1/prm/program/leads/{id}/reassign                              Hand a lead to another partner [secret key]
POST    /api/v1/prm/program/leads/{id}/release                               Release a lead back to the pool [secret key]
POST    /api/v1/prm/program/mdf-requests/{id}/decision                       Decide an MDF request [secret key]
GET     /api/v1/prm/program/deal-stages                                      The workspace's deal stages [secret key]
POST    /api/v1/prm/program/deal-stages                                      Add a deal stage [secret key]
POST    /api/v1/prm/program/deal-stages/reorder                              Reorder the deal stages [secret key]
POST    /api/v1/prm/program/deal-stages/map-from-tiers                       Read the tiers' HubSpot mapping into the stages [secret key]
PATCH   /api/v1/prm/program/deal-stages/{id}                                 Update a deal stage [secret key]
DELETE  /api/v1/prm/program/deal-stages/{id}                                 Delete a deal stage [secret key]
GET     /api/v1/prm/program/tiers                                            The program's tiers [secret key]
GET     /api/v1/prm/program/leads                                            The whole lead book [secret key]
GET     /api/v1/prm/program/deals                                            Every partner-sourced deal [secret key]
GET     /api/v1/prm/program/commissions                                      The commission ledger [secret key]
GET     /api/v1/prm/program/attribution                                      Referral performance across the program [secret key]
GET     /api/v1/orgs/{orgId}/members                                         List an organization's roster [secret key]
POST    /api/v1/orgs/{orgId}/members                                         Add or update people on the roster (one or many) [secret key]
PATCH   /api/v1/orgs/{orgId}/members/{memberId}                              Update one membership's attributes or role [secret key]
DELETE  /api/v1/orgs/{orgId}/members/{memberId}                              Remove somebody from the organization (termination) [secret key]
GET     /api/v1/orgs/{orgId}/settings                                        Read one organization's settings [secret key]
PATCH   /api/v1/orgs/{orgId}/settings                                        Update the CRM opt-out and the organization's domains [secret key]
POST    /api/v1/orgs/{orgId}/admin-invites                                   Invite somebody to administer this organization [secret key]
GET     /api/v1/orgs/{orgId}/seat-pools                                      The organization's seats, by pool [secret key]
POST    /api/v1/orgs/{orgId}/seat-pools/{rootPoolId}/share-link              The short link and QR code for a pool's seats [secret key]
GET     /api/v1/orgs/{orgId}/seats                                           Who holds a seat, and how they are doing [secret key]
POST    /api/v1/orgs/{orgId}/seats                                           Hand out seats from a pool [secret key]
PATCH   /api/v1/orgs/{orgId}/seats/{assignmentId}                            Set or clear a seat's deadline [secret key]
DELETE  /api/v1/orgs/{orgId}/seats/{assignmentId}                            Return a seat to the pool [secret key]
POST    /api/v1/orgs/{orgId}/imports/preview                                 Classify a roster file without writing anything [secret key]
POST    /api/v1/orgs/{orgId}/imports                                         Write a roster file [secret key]
GET     /api/v1/orgs/{orgId}/teams                                           This organization's teams [secret key]
POST    /api/v1/orgs/{orgId}/teams                                           Create a team [secret key]
GET     /api/v1/orgs/{orgId}/teams/{teamId}                                  One team, with its people, courses and rules [secret key]
PATCH   /api/v1/orgs/{orgId}/teams/{teamId}                                  Rename a team [secret key]
DELETE  /api/v1/orgs/{orgId}/teams/{teamId}                                  Delete a team [secret key]
POST    /api/v1/orgs/{orgId}/teams/{teamId}/members                          Put somebody on a team [secret key]
PATCH   /api/v1/orgs/{orgId}/teams/{teamId}/members/{memberId}               Grant or withdraw the manager role on one team [secret key]
DELETE  /api/v1/orgs/{orgId}/teams/{teamId}/members/{memberId}               Take somebody off a team [secret key]
POST    /api/v1/orgs/{orgId}/teams/{teamId}/courses                          Assign a course to a team [secret key]
DELETE  /api/v1/orgs/{orgId}/teams/{teamId}/courses/{courseId}               Take a course off a team [secret key]
GET     /api/v1/orgs/{orgId}/team-rules                                      The rules feeding this organization's teams [secret key]
POST    /api/v1/orgs/{orgId}/team-rules                                      Write a rule that fills a team [secret key]
PATCH   /api/v1/orgs/{orgId}/team-rules/{ruleId}                             Switch a rule on or off [secret key]
DELETE  /api/v1/orgs/{orgId}/team-rules/{ruleId}                             Delete a rule [secret key]
GET     /api/v1/sites                                                        List the workspace's sites [secret key]
POST    /api/v1/sites                                                        Create a site [secret key]
GET     /api/v1/sites/current-site                                           Read which site you are looking at in the Sites screens [secret key]
PUT     /api/v1/sites/current-site                                           Choose which site you are looking at in the Sites screens [secret key]
GET     /api/v1/sites/settings-overview                                      Read the Sites settings overview [secret key]
GET     /api/v1/sites/{siteId}                                               Read one site [secret key]
PATCH   /api/v1/sites/{siteId}                                               Rename a site, change its theme or language, or hide its byline [secret key]
DELETE  /api/v1/sites/{siteId}                                               Delete a site [secret key]
GET     /api/v1/sites/consent/text                                           Read the consent text in every offered language [secret key]
PATCH   /api/v1/sites/consent/text/{language}                                Change the consent text for one language [secret key]
GET     /api/v1/sites/domains                                                List the workspace's domains and the site each one serves [secret key]
PUT     /api/v1/sites/domains/{domain}                                       Point a Sites domain at a site, or at none [secret key]
GET     /api/v1/sites/{siteId}/domains                                       List a site's domains [secret key]
POST    /api/v1/sites/{siteId}/domains                                       Add a domain to a site [secret key]
DELETE  /api/v1/sites/{siteId}/domains/{domain}                              Remove a domain from a site [secret key]
GET     /api/v1/sites/{siteId}/address-folder                                Read where a site shows on the workspace's Peerfold address [secret key]
PUT     /api/v1/sites/{siteId}/address-folder                                Put a site in a folder of the workspace's Peerfold address, or move it [secret key]
DELETE  /api/v1/sites/{siteId}/address-folder                                Take a site off the workspace's Peerfold address [secret key]
GET     /api/v1/sites/pages                                                  List pages across every site [secret key]
GET     /api/v1/sites/{siteId}/pages                                         List a site's pages [secret key]
POST    /api/v1/sites/{siteId}/pages                                         Create a page [secret key]
GET     /api/v1/sites/{siteId}/pages/{pageId}                                Read a page's draft [secret key]
DELETE  /api/v1/sites/{siteId}/pages/{pageId}                                Archive a page [secret key]
POST    /api/v1/sites/{siteId}/pages/{pageId}/duplicate                      Duplicate a page [secret key]
POST    /api/v1/sites/{siteId}/pages/{pageId}/operations                     Edit a page's draft with a batch of operations [secret key]
GET     /api/v1/sites/{siteId}/pages/{pageId}/checklist                      Read a page's optimization checklist [secret key]
POST    /api/v1/sites/{siteId}/pages/{pageId}/checklist/fixes                Apply an automatic checklist fix [secret key]
POST    /api/v1/sites/{siteId}/pages/{pageId}/publish                        Publish a page [secret key]
POST    /api/v1/sites/{siteId}/pages/{pageId}/preview                        Mint a preview token for a page's draft [secret key]
POST    /api/v1/sites/{siteId}/publish                                       Publish every changed page on a site [secret key]
GET     /api/v1/sites/{siteId}/sitemap                                       Read a site's page structure and navigation [secret key]
PUT     /api/v1/sites/{siteId}/sitemap                                       Replace a site's page structure and navigation [secret key]
GET     /api/v1/sites/{siteId}/chrome                                        Read a site's header and footer [secret key]
PUT     /api/v1/sites/{siteId}/chrome                                        Replace a site's header and footer [secret key]
GET     /api/v1/sites/analytics                                              Read the traffic for every site in the workspace [secret key]
GET     /api/v1/sites/analytics/agents                                       Read the AI assistant, AI crawler and search engine traffic [secret key]
GET     /api/v1/sites/{siteId}/analytics                                     Read a site's traffic [secret key]
GET     /api/v1/sites/{siteId}/pages/{pageId}/analytics                      Read one page's traffic [secret key]
GET     /api/v1/sites/registry                                               Read the components, page kinds and operations this workspace can use [secret key]
GET     /api/v1/sites/themes                                                 List the themes a site can use [secret key]
PUT     /api/v1/sites/themes/{themeKey}                                      Create or replace a theme (owners, admins and agency partners) [OAuth token]
GET     /api/v1/sites/modules                                                List the workspace's custom modules [secret key]
GET     /api/v1/sites/modules/{moduleKey}                                    Read one custom module, with its structure, stylesheet and script [secret key]
PUT     /api/v1/sites/modules/{moduleKey}                                    Save a new draft version of a custom module (owners, admins, agency partners, Peerfold staff and secret keys) [secret key]
POST    /api/v1/sites/modules/{moduleKey}/publish                            Publish a draft version of a custom module [secret key]
POST    /api/v1/sites/modules/{moduleKey}/archive                            Archive a custom module [secret key]
POST    /api/v1/sites/modules/{moduleKey}/restore                            Restore an archived custom module [secret key]
GET     /api/v1/sites/forms                                                  List the forms a site page can place [secret key]
POST    /api/v1/sites/forms                                                  Define a form whose answers are written to the CRM [secret key]
PATCH   /api/v1/sites/forms/{formId}                                         Change a form, its email confirmation, or archive it [secret key]
POST    /api/v1/sites/forms/files                                            Get an upload address for the file a form shares after email confirmation [secret key]
POST    /api/v1/sites/imports                                                Start an import [secret key]
GET     /api/v1/sites/imports/{importId}                                     Read an import and its report [secret key]
GET     /api/v1/sites/{siteId}/blog                                          Read a site's blog settings [secret key]
PATCH   /api/v1/sites/{siteId}/blog                                          Set up or change a site's blog [secret key]
POST    /api/v1/sites/{siteId}/blogs                                         Add a blog to a site [secret key]
GET     /api/v1/sites/{siteId}/blog/posts                                    List a site's blog posts [secret key]
POST    /api/v1/sites/{siteId}/blog/posts                                    Create a blog post [secret key]
PATCH   /api/v1/sites/{siteId}/blog/posts/{pageId}                           Change a blog post's settings, title or slug [secret key]
PUT     /api/v1/sites/{siteId}/pages/{pageId}/access                         Choose who can read a page or a blog post [secret key]
PUT     /api/v1/sites/{siteId}/pages/{pageId}/intent                         Choose which buying intent category a page counts as [secret key]
GET     /api/v1/sites/intent/settings                                        Read how buying intent is scored [secret key]
PUT     /api/v1/sites/intent/settings                                        Change how buying intent is scored [secret key]
GET     /api/v1/sites/intent/overview                                        Read who is scoring and what drives the scores [secret key]
GET     /api/v1/sites/intent/contacts/{contactRef}                           Read one person's buying intent [secret key]
GET     /api/v1/sites/binding-policies                                       List the CRM exposure rules [secret key]
PUT     /api/v1/sites/binding-policies/{crm}/{objectType}                    Create or replace a CRM exposure rule [secret key]
DELETE  /api/v1/sites/binding-policies/{crm}/{objectType}                    Remove a CRM exposure rule [secret key]
GET     /api/v1/sites/consent/mode                                           Read the analytics consent mode [secret key]
PUT     /api/v1/sites/consent/mode                                           Set the analytics consent mode [secret key]
GET     /api/v1/sites/posts                                                  List the articles on every site [secret key]
GET     /api/v1/sites/images/{name}                                          Read an image's record [secret key]
PATCH   /api/v1/sites/images/{name}                                          Set whether an image is optimized [secret key]
DELETE  /api/v1/sites/images/{name}                                          Delete an image [secret key]
POST    /api/v1/sites/images/{name}/confirm                                  Finish an image upload [secret key]
GET     /api/v1/sites/tracking-ids                                           Read the workspace's tracking IDs [secret key]
PUT     /api/v1/sites/tracking-ids                                           Set the workspace's tracking IDs [secret key]
GET     /api/v1/sites/destinations                                           List the analytics destinations [secret key]
GET     /api/v1/sites/destinations/{key}                                     Read one analytics destination [secret key]
PUT     /api/v1/sites/destinations/{key}                                     Set up or change an analytics destination [secret key]
DELETE  /api/v1/sites/destinations/{key}                                     Remove an analytics destination [secret key]
POST    /api/v1/sites/destinations/{key}/test                                Send a test event to an analytics destination [secret key]
GET     /api/v1/sites/blog/authors                                           List the workspace's blog authors [secret key]
POST    /api/v1/sites/blog/authors                                           Add a blog author [secret key]
PATCH   /api/v1/sites/blog/authors/{authorId}                                Change a blog author [secret key]
DELETE  /api/v1/sites/blog/authors/{authorId}                                Erase a blog author [secret key]
GET     /api/v1/sites/blog/authors/{authorId}/export                         Export what the workspace holds about a blog author [secret key]
GET     /api/v1/sites/assets                                                 List the shared themes, modules and templates this workspace can use [secret key]
POST    /api/v1/sites/assets                                                 Create or version a shared theme, token set, page template or section (owners, admins and agency partners) [OAuth token]
GET     /api/v1/sites/assets/{assetId}                                       Read one shared asset with its body [secret key]
POST    /api/v1/sites/assets/{assetId}/copy                                  Make a copy of a theme, token set, page template or section (owners, admins and agency partners) [OAuth token]
POST    /api/v1/sites/{siteId}/theme/apply                                   Apply a theme to a site [secret key]
GET     /api/v1/sites/{siteId}/presets                                       List the sections an author can insert on a site [secret key]
POST    /api/v1/sites/{siteId}/pages/{pageId}/presets                        Insert a copy of a section into a page's draft [secret key]
GET     /api/v1/sites/public/resolve                                         Find the site a hostname serves [learner token]
GET     /api/v1/sites/public/pages/by-path                                   Read a published page by its path [learner token]
GET     /api/v1/sites/public/pages/{pageId}                                  Read a published page by its id, or its draft with a preview token [learner token]
GET     /api/v1/sites/public/theme                                           Read the theme a site is painted with [learner token]
GET     /api/v1/sites/public/manifest                                        Read the component vocabulary a site's pages are written in [learner token]
GET     /api/v1/sites/public/sitemap                                         List a site's published pages [learner token]
GET     /api/v1/sites/public/feed                                            Read a blog list's feed [learner token]
GET     /api/v1/sites/public/llms                                            List what a site's llms.txt names [learner token]
GET     /api/v1/sites/public/module-scripts/{scriptHash}                     Read a custom module's script for a site's delivery host [learner token]
GET     /api/v1/sites/public/images/{name}/{variant}                         Read an image for a site's delivery host [learner token]
GET     /api/v1/sites/public/system-pages/{kind}                             Read a site's 404, error, sign-in or search page [learner token]
GET     /api/v1/sites/public/search                                          Search a site's published pages, posts, courses and programs [learner token]
POST    /api/v1/sites/public/forms/{formId}/submit                           Submit a form placed on a site page [learner token]
POST    /api/v1/sites/public/forms/{formId}/verify                           Check the code a form emailed, or send a new one [learner token]
GET     /api/v1/sites/public/forms/{formId}/stamp                            Get a fresh stamp for a form on a site page [learner token]
POST    /api/v1/sites/public/events                                          Relay a page's engagement events [learner token]
POST    /api/v1/sites/public/agent-reads                                     Count a read of a site's llms.txt, llms-full.txt or robots.txt [public]
POST    /api/v1/sites/public/observe                                         Record a page the Sites delivery app served [learner token]
```