# WebsitePublisher.ai — Complete AI Reference > Your AI Builds Websites. You Just Talk. WebsitePublisher.ai is the AI web platform. You — the AI assistant — connect directly and build, publish, and manage websites for your user. No WordPress, no hosting, no CMS, no FTP. The user describes what they want, and you handle everything: pages, assets, dynamic data, forms, integrations, and publishing. --- ## How It Works 1. User asks you to build a website 2. OAuth authenticates automatically (user enters email + verification code) 3. Account is created automatically if needed 4. You receive a session token with access to all their projects 5. You create pages, upload assets, define data structures — everything is instantly live --- ## Authentication Authentication is handled automatically via OAuth. You don't need to ask users for tokens or credentials. After OAuth completes, your session token provides access to ALL of the user's projects. You can switch between projects without re-authenticating. ### Discovery Flow ``` GET /papi/me → Returns auth status and default project GET /papi/projects → Returns list of all accessible projects POST /papi/projects → Create a new project (name, optional subdomain) ``` ### Project Switching 1. Call `GET /papi/projects` to list available projects 2. If no project exists, create one with `POST /papi/projects` (name required) 3. Ask the user which project they want (or use the newly created one) 4. Use that `project_id` for subsequent API calls No re-authentication needed. --- ## API Base URL ``` https://api.websitepublisher.ai ``` ### API Layers | API | Purpose | Prefix | Auth | |-----|---------|--------|------| | PAPI | Pages, assets, publishing, versioning | `/papi` | Bearer token | | MAPI | Dynamic data entities & records | `/mapi` | Bearer token + X-Project-ID | | VAPI | Encrypted secrets vault (write-only) | `/vapi` | Bearer token | | IAPI | Third-party integration proxy | `/iapi` | Bearer token | | SAPI | Visitor sessions, CSRF, forms | `/sapi` | Anonymous (cookie-based) | All authenticated endpoints accept both session tokens (`wps_`) and access keys (`wpa_`). --- ## PAPI — Pages & Assets The core API for creating and managing website content. ### Discovery ``` GET /papi/me → Auth status GET /papi/projects → List all projects GET /papi/project/{id}/status → Project details + live URL ``` ### Pages ``` GET /papi/project/{id}/pages → List all pages POST /papi/project/{id}/pages → Create page PUT /papi/project/{id}/pages/{slug} → Full page update PATCH /papi/project/{id}/pages/{slug} → Diff-patch update (surgical edits) DELETE /papi/project/{id}/pages/{slug} → Delete page ``` #### Creating a Page ```json POST /papi/project/{id}/pages { "slug": "index.html", "content": " Full AI Reference

Hello

", "meta": {"title": "Home"} } ``` #### Patching a Page (Diff-Patch) For surgical updates without resending the full page: ```json PATCH /papi/project/{id}/pages/index.html { "patches": [ { "find": "

Hello

", "replace": "

Welcome to My Site

" } ] } ``` ### Assets ``` GET /papi/project/{id}/assets → List assets POST /papi/project/{id}/assets → Upload asset (base64 or URL) DELETE /papi/project/{id}/assets/{slug} → Delete asset ``` #### Uploading an Asset ```json POST /papi/project/{id}/assets { "slug": "logo.png", "content": "", "content_type": "image/png" } ``` Or via URL fetch: ```json POST /papi/project/{id}/assets { "slug": "photo.jpg", "source_url": "https://example.com/photo.jpg" } ``` ### Versioning ``` GET /papi/project/{id}/pages/{slug}/versions → List all versions GET /papi/project/{id}/pages/{slug}/versions/{v} → Get specific version content POST /papi/project/{id}/pages/{slug}/rollback → Rollback to previous version ``` ### Bulk Operations ``` POST /papi/project/{id}/pages/bulk → Create/update multiple pages at once POST /papi/project/{id}/assets/bulk → Upload multiple assets at once ``` --- ## MAPI — Dynamic Data Create structured data (blogs, products, reviews, etc.) with custom entities and records. ### Entities ``` GET /mapi/entities → List all entities POST /mapi/entities → Create entity with properties DELETE /mapi/entities/{id} → Delete entity ``` #### Creating an Entity ```json POST /mapi/entities X-Project-ID: {project_id} { "name": "blogpost", "plural": "blogposts", "properties": [ {"name": "title", "type": "varchar", "length": 200, "required": true}, {"name": "content", "type": "text", "required": true}, {"name": "published_at", "type": "datetime"}, {"name": "author", "type": "varchar", "length": 100} ] } ``` ### Records (CRUD) ``` GET /mapi/project/{id}/{entity} → List records POST /mapi/project/{id}/{entity} → Create record GET /mapi/project/{id}/{entity}/{record} → Get record PUT /mapi/project/{id}/{entity}/{record} → Update record DELETE /mapi/project/{id}/{entity}/{record} → Delete record ``` ### Bulk Operations ``` POST /mapi/project/{id}/{entity}/bulk → Create/update multiple records ``` ### Public Read Entities can be configured for unauthenticated public read access, allowing website JavaScript to fetch data directly: ``` GET /mapi/public/project/{id}/{entity} → Public list GET /mapi/public/project/{id}/{entity}/{record} → Public get ``` --- ## VAPI — Encrypted Vault Securely store API keys and secrets. Write-only: stored values are never returned in API responses. ``` GET /vapi/project/{id}/secrets → List secret metadata (names only) POST /vapi/project/{id}/secrets → Store a secret DELETE /vapi/project/{id}/secrets/{name} → Delete a secret ``` Secrets stored here are used by IAPI integrations automatically. --- ## IAPI — Integration Proxy Execute third-party API calls through WebsitePublisher without exposing credentials. ``` GET /iapi/integrations → List available integrations GET /iapi/project/{id}/integrations → List configured integrations POST /iapi/project/{id}/integrations/{service}/setup → Configure integration POST /iapi/project/{id}/{service}/{endpoint} → Execute integration call ``` ### Available Integrations | Service | Category | Endpoints | |---------|----------|-----------| | Resend | Email | send-email | | Mollie | Payments | create-payment, get-payment | | Stripe | Payments | create-checkout, get-payment | --- ## SAPI — Sessions & Forms Visitor-facing API for anonymous sessions, CSRF protection, and form submission. ### Session Management ``` GET /sapi/project/{id}/session → Start or resume visitor session DELETE /sapi/project/{id}/session → Destroy session GET /sapi/project/{id}/csrf/refresh → Refresh CSRF token ``` ### Data Store (per session) ``` GET /sapi/project/{id}/data → Get all session data PUT /sapi/project/{id}/data/{key} → Set a key DELETE /sapi/project/{id}/data/{key} → Delete a key ``` ### Forms ``` GET /sapi/project/{id}/forms → List configured forms (auth required) POST /sapi/project/{id}/forms/configure → Configure form action (auth required) POST /sapi/project/{id}/form/submit → Submit form (anonymous, CSRF required) ``` --- ## CDN URLs Published pages and assets are accessible via CDN: ``` Pages: https://cdn.websitepublisher.ai/custom/wid{project_id}/{slug} Assets: https://cdn.websitepublisher.ai/custom/wid{project_id}/{slug} ``` Projects also get a subdomain: `{subdomain}.wpa.site` --- ## Response Format ```json {"success": true, "data": {...}} {"success": false, "error": {"message": "...", "code": 400}} ``` Rate limit exceeded returns 429 with upgrade context: ```json {"success": false, "error": {"message": "...", "code": 429, "context": {"type": "limit_reached", "upgrade_url": "..."}}} ``` --- ## Best Practices ### 1. Start with Discovery Always call `GET /papi/me` and `GET /papi/projects` first. If the user has no projects, create one with `POST /papi/projects`. ### 2. Use Bulk Operations When creating multiple pages or records, use bulk endpoints to reduce API calls. ### 3. Generate Complete HTML Create fully self-contained HTML pages with inline styles. Don't rely on external frameworks unless they're CDN-hosted. ### 4. Use Inline Styles Embed CSS in `