statichost.dev API

Who am I — the key owner, plan, limits and usage

{
  "user": {
    "id": "k2j4…",
    "email": "you@example.com",
    "name": "You"
  },
  "plan": "free",
  "limits": {
    "sites": 2,
    "maxSiteBytes": 104857600,
    "customDomains": false,
    "badge": true
  },
  "usage": {
    "sites": 1
  }
}

curl -s https://statichost.dev/api/v1/me \
  -H "Authorization: Bearer $KEY"

Is a GluedEasy key connected (for {{{workflow}}} tags)?

Shows whether pages can run GluedEasy workflows and how they are connected (via: "key" = a pasted key, "authlock" = Connect with AuthLock). The key itself is never returned — only a hint.

{
  "connected": true,
  "via": "key",
  "key": "sk_4f2…9a1c · you@example.com",
  "gluedeasyUrl": "https://gluedeasy.com"
}

curl -s https://statichost.dev/api/v1/integrations/gluedeasy \
  -H "Authorization: Bearer $KEY"

Connect (or replace) your GluedEasy API key

The key is checked against GluedEasy first, then stored encrypted. Every {{{workflow}}} tag in your pages runs with it — see "Dynamic pages" above. Create the key in GluedEasy under Settings → API Keys, with write access to the workflows your pages use.

Parameters

{
  "apiKey": "sk_..."
}

{
  "connected": true,
  "via": "key",
  "key": "sk_4f2…9a1c · you@example.com",
  "gluedeasyUrl": "https://gluedeasy.com"
}

curl -s \
  -X PUT https://statichost.dev/api/v1/integrations/gluedeasy \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"apiKey":"sk_..."}'

Errors: 400 invalid_gluedeasy_key 429 rate_limited

List the GluedEasy workflows your pages can use

Live, published workflows your connected GluedEasy key can run — the names to put in {{{…}}} tags. The editor autocompletes from this.

{
  "workflows": [
    {
      "id": "wf_abc123",
      "slug": "opening-hours",
      "name": "Opening hours",
      "description": "Today's hours for the shop"
    }
  ]
}

curl -s https://statichost.dev/api/v1/integrations/gluedeasy/workflows \
  -H "Authorization: Bearer $KEY"

Errors: 409 gluedeasy_not_connected 400 gluedeasy_key_rejected 502 gluedeasy_unavailable

One workflow: steps and the input names its code reads

{ref} is a workflow id (wf_…) or slug. inputs lists the argument names the entry step reads (input.x, destructured parameters, TypeScript input types) — inferred from the code, since GluedEasy has no input schema; use them as name=value in the tag.

{
  "id": "wf_abc123",
  "slug": "opening-hours",
  "name": "Opening hours",
  "description": "…",
  "entryStep": "hours",
  "inputs": [
    "day",
    "shop"
  ],
  "steps": [
    {
      "id": "hours",
      "trigger": "rest",
      "inputs": [
        "day",
        "shop"
      ]
    }
  ]
}

curl -s https://statichost.dev/api/v1/integrations/gluedeasy/workflows/opening-hours \
  -H "Authorization: Bearer $KEY"

Errors: 404 not_found 409 gluedeasy_not_connected 502 gluedeasy_unavailable

Disconnect GluedEasy

Removes the stored key. Tags in your pages then render their @fallback (or nothing).

{
  "connected": false,
  "via": null,
  "key": null,
  "gluedeasyUrl": "https://gluedeasy.com"
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/integrations/gluedeasy \
  -H "Authorization: Bearer $KEY"

Is your GitFork account connected (via AuthLock)?

{
  "connected": true,
  "hint": "via AuthLock · repos:write · until 2027-10-02 · you@example.com",
  "connectedAt": "…",
  "gitforkUrl": "https://gitfork.eu"
}

curl -s https://statichost.dev/api/v1/integrations/gitfork \
  -H "Authorization: Bearer $KEY"

Your GitFork repositories (to pick one for a site)

Parameters

{
  "repos": [
    {
      "id": "r8k2…",
      "fullName": "you/site",
      "defaultBranch": "main",
      "isPrivate": true,
      "canMintKey": true,
      "cloneUrl": "https://gitfork.eu/repos/you/site.git"
    }
  ]
}

curl -s https://statichost.dev/api/v1/integrations/gitfork/repos \
  -H "Authorization: Bearer $KEY"

Errors: 409 gitfork_not_connected

Disconnect GitFork (revokes the access; sites linked through it stop syncing)

{
  "connected": false,
  "sitesAffected": 1
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/integrations/gitfork \
  -H "Authorization: Bearer $KEY"

List your projects (sites) — your own and the ones shared with you

Each project carries role: owner for your own sites, else your member role (admin, editor, viewer) on a site shared with you.

{
  "projects": [
    {
      "id": "29ufe",
      "name": "My site",
      "url": "https://29ufe.statichost.dev",
      "homeFile": "index.html",
      "passwordProtected": false,
      "totalBytes": 48213,
      "fileCount": 7,
      "paused": null,
      "domains": [],
      "role": "owner"
    }
  ]
}

curl -s https://statichost.dev/api/v1/projects \
  -H "Authorization: Bearer $KEY"

Create a project

Mints a new site with a random id. Fails with 403 site_limit when the plan allowance is used up.

Parameters

{
  "name": "My site",
  "description": "Landing page"
}

201 {
  "id": "29ufe",
  "name": "My site",
  "url": "https://29ufe.statichost.dev",
  "homeFile": null,
  …
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"name":"My site"}'

Errors: 403 site_limit

One project, including its file list

Parameters

{
  "id": "29ufe",
  …,
  "files": [
    {
      "path": "index.html",
      "size": 1520,
      "contentType": "text/html; charset=utf-8",
      "dynamic": false,
      "updatedAt": "…"
    }
  ]
}

curl -s https://statichost.dev/api/v1/projects/29ufe \
  -H "Authorization: Bearer $KEY"

Rename, describe, pick the home file, set or clear the password

Parameters

{
  "name": "Portfolio",
  "homeFile": "start.html",
  "password": "hunter22"
}

{
  "id": "29ufe",
  "name": "Portfolio",
  "homeFile": "start.html",
  "passwordProtected": true,
  …
}

curl -s \
  -X PATCH https://statichost.dev/api/v1/projects/29ufe \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"homeFile":"start.html"}'

Errors: 400 invalid_home_file 400 invalid_password 400 invalid_publish_mode

Delete a project and all its files

{
  "deleted": true
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe \
  -H "Authorization: Bearer $KEY"

Releases: test vs production, what changed, and the saved versions

Every site has a test copy (what uploads, the editor and git change; always served at testUrl) and production (productionUrl + custom domains). mode auto: production is the test copy and a release is saved automatically about a minute after each burst of changes (and right after a zip upload or git pull). mode manual (test & publish): production serves live until you publish. pending lists what the test copy has that production (manual) or the newest release (auto) does not. undo is the release Undo would bring back. Releases share files, so they cost no storage until a file is replaced; the newest 50 are kept (fewer when old ones hold more than 3× the plan's site size).

Parameters

{
  "mode": "manual",
  "productionUrl": "https://29ufe.statichost.dev",
  "testUrl": "https://29ufe-test.statichost.dev",
  "live": {
    "id": "q3…",
    "number": 7,
    "message": "New pricing page",
    "live": true,
    …
  },
  "pending": {
    "added": [
      "blog/new.html"
    ],
    "changed": [
      "index.html"
    ],
    "removed": [],
    "homeFileChanged": false,
    "total": 2
  },
  "undo": {
    "number": 6,
    "id": "k9…"
  },
  "retainedBytes": 18432,
  "keep": 50,
  "releases": [
    {
      "id": "q3…",
      "number": 7,
      "message": "New pricing page",
      "source": "publish",
      "fileCount": 41,
      "totalBytes": 2356493,
      "createdBy": "you@example.com",
      "createdAt": "…",
      "live": true,
      "lastLiveAt": "…"
    },
    …
  ]
}

curl -s https://statichost.dev/api/v1/projects/29ufe/releases \
  -H "Authorization: Bearer $KEY"

Publish the test copy to production (manual) / save a named release (auto)

manual mode: freezes the test copy as a new release and makes it production (201); when the test copy is identical to an existing newest release, that one goes live instead, and changed: false when it already was. auto mode: saves the current state as a release with your message. Editors and up. The response is the same shape as GET …/releases, plus changed and release.

Parameters

{
  "message": "New pricing page"
}

{
  "changed": true,
  "release": {
    "number": 8,
    "message": "New pricing page",
    "live": true,
    …
  },
  "mode": "manual",
  "live": {
    "number": 8,
    …
  },
  "pending": {
    "total": 0,
    …
  },
  …
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/releases \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"message":"New pricing page"}'

One release: its files, and how the test copy differs from it

{release} is the release id or its number (7). testChanges = what the test copy has that this release does not.

{
  "id": "q3…",
  "number": 7,
  "message": "New pricing page",
  "live": true,
  "files": [
    {
      "path": "index.html",
      "size": 5120,
      "contentType": "text/html; charset=utf-8"
    },
    …
  ],
  "testChanges": {
    "added": [],
    "changed": [
      "index.html"
    ],
    "removed": [],
    "homeFileChanged": false,
    "total": 1
  }
}

curl -s https://statichost.dev/api/v1/projects/29ufe/releases/7 \
  -H "Authorization: Bearer $KEY"

Errors: 404 release_not_found

Roll production back (or forward) to a release

manual mode: production serves that release at once — nothing is copied, the test copy is untouched. auto mode: the current state is saved first, then the site (= test copy = production) becomes that release and is saved as a new release "Back to release #N". Editors and up.

{
  "changed": true,
  "release": {
    "number": 6,
    "live": true,
    …
  },
  "mode": "manual",
  …
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/releases/6/rollback \
  -H "Authorization: Bearer $KEY"

Errors: 404 release_not_found 413 site_too_large

Load a release into the test copy

manual mode: the test copy becomes that release so you can keep working from it; production does not change. Unpublished test changes are saved as a release first, so nothing is lost. auto mode: same as rollback. Editors and up.

{
  "changed": true,
  "release": {
    "number": 5,
    …
  },
  "pending": {
    "total": 3,
    …
  },
  …
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/releases/5/restore \
  -H "Authorization: Bearer $KEY"

Errors: 404 release_not_found 413 site_too_large

Undo the last publish or rollback

manual mode: production goes back to what it served before the last publish/rollback (Undo again = redo). auto mode: back to the previous saved state — unsaved changes from the last minute are saved first, so Undo again brings them back. Editors and up.

{
  "changed": true,
  "release": {
    "number": 6,
    "live": true,
    …
  },
  "undo": {
    "number": 7,
    …
  },
  …
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/undo \
  -H "Authorization: Bearer $KEY"

Errors: 409 nothing_to_undo 413 site_too_large

Purge the CDN cache of a site

Site files are cached at the CDN edge and purged automatically whenever the site changes (uploads, deletes, settings, domains, plan). Use this only if you need a manual refresh. 404 cdn_disabled when the server does not edge-cache sites.

{
  "purged": true,
  "hosts": [
    "29ufe.statichost.dev",
    "www.example.com"
  ]
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/purge \
  -H "Authorization: Bearer $KEY"

Errors: 404 cdn_disabled 429 rate_limited 502 cdn_unavailable

Who works on this site: owner, members and (for admins) pending invites

you is your role. Admins and the owner also see pending/expired invites.

{
  "you": "owner",
  "owner": {
    "email": "you@example.com",
    "name": "You"
  },
  "members": [
    {
      "id": "m4k2…",
      "email": "sam@example.com",
      "name": "Sam",
      "role": "editor",
      "status": "active",
      "invitedAs": "sam@example.com",
      "invitedAt": "2026-09-28T09:00:00.000Z",
      "acceptedAt": "2026-09-28T09:05:00.000Z"
    }
  ]
}

curl -s https://statichost.dev/api/v1/projects/29ufe/members \
  -H "Authorization: Bearer $KEY"

Invite someone to the site (admin/owner)

Emails a one-time invite link (valid 14 days) and returns it as inviteUrl so you can share it yourself too. Inviting a pending address again refreshes its link and role.

Parameters

{
  "email": "sam@example.com",
  "role": "editor"
}

201 {
  "id": "m4k2…",
  "email": "sam@example.com",
  "role": "editor",
  "status": "pending",
  "inviteUrl": "https://statichost.dev/invite/…"
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/members \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"email":"sam@example.com","role":"editor"}'

Errors: 400 invalid_email 400 invalid_role 403 forbidden 409 already_member 403 member_limit

Change a member's role (admin/owner)

Parameters

{
  "role": "admin"
}

{
  "id": "m4k2…",
  "email": "sam@example.com",
  "role": "admin",
  "status": "active"
}

curl -s \
  -X PATCH https://statichost.dev/api/v1/projects/29ufe/members/m4k2 \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"role":"admin"}'

Remove a member or revoke an invite (admin/owner) — or leave the site yourself

{
  "deleted": true
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe/members/m4k2 \
  -H "Authorization: Bearer $KEY"

Send a pending invite again with a fresh link (admin/owner)

{
  "id": "m4k2…",
  "status": "pending",
  "inviteUrl": "https://statichost.dev/invite/…"
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/members/m4k2/resend \
  -H "Authorization: Bearer $KEY"

Recent changes on the site, by anyone (newest first)

Parameters

{
  "events": [
    {
      "at": "2026-09-28T09:10:00.000Z",
      "action": "file.save",
      "by": "sam@example.com",
      "detail": {
        "path": "index.html",
        "size": 5120
      }
    }
  ]
}

curl -s https://statichost.dev/api/v1/projects/29ufe/activity \
  -H "Authorization: Bearer $KEY"

The site's repository connection (if any) and its sync state

Admins/owners also get deployKey (GitHub) and the webhook URL + secret.

{
  "connected": true,
  "provider": "github",
  "repo": "you/site",
  "branch": "main",
  "folder": "",
  "mode": "both",
  "autoPush": true,
  "access": {
    "read": true,
    "write": true,
    "checkedAt": "…",
    "error": null
  },
  "syncedCommit": "4be1c0d…",
  "pendingChanges": false,
  "lastPullAt": "…",
  "lastPushAt": "…",
  "lastError": null,
  "deployKey": "ssh-ed25519 AAAA… statichost.dev site 29ufe",
  "webhook": {
    "url": "https://statichost.dev/hooks/git/29ufe",
    "secret": "…",
    "contentType": "application/json",
    "events": [
      "push"
    ]
  }
}

curl -s https://statichost.dev/api/v1/projects/29ufe/git \
  -H "Authorization: Bearer $KEY"

Connect the site to a GitHub or GitFork repository (admin/owner)

GitHub: returns a fresh deployKey to add to the repo (re-connecting the same repo keeps the key unless newKey). GitFork: needs your GitFork connection (GET /api/v1/integrations/gitfork); statichost mints a key for that repo (read-only for pull).

Parameters

{
  "provider": "github",
  "repo": "you/site",
  "branch": "main",
  "mode": "both"
}

201 {
  "connected": true,
  "provider": "github",
  "repo": "you/site",
  "deployKey": "ssh-ed25519 AAAA…",
  "access": null,
  …
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/git \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"provider":"github","repo":"you/site","mode":"both"}'

Errors: 400 invalid_repo 400 invalid_branch 400 invalid_mode 409 gitfork_not_connected 404 repo_not_found

Change branch, folder, mode or auto-push (admin/owner)

{
  "mode": "push",
  "autoPush": true
}

{
  "connected": true,
  "mode": "push",
  "autoPush": true,
  …
}

curl -s \
  -X PATCH https://statichost.dev/api/v1/projects/29ufe/git \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"mode":"push"}'

Disconnect the repository (nothing is deleted on either side)

{
  "connected": false
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe/git \
  -H "Authorization: Bearer $KEY"

Test the connection: can statichost pull (read) and push (write)?

{
  "read": true,
  "write": false,
  "empty": false,
  "branchExists": true,
  "defaultBranch": "main",
  "error": "The key you are authenticating with has been marked as read only."
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/git/check \
  -H "Authorization: Bearer $KEY"

Publish the branch folder to the site (replaces all site files)

Parameters

{
  "commit": "4be1c0d…",
  "uploaded": 42,
  "removed": 3,
  "skipped": []
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/git/pull \
  -H "Authorization: Bearer $KEY"

Errors: 409 site_has_changes 409 mode_push_only 404 branch_not_found 409 git_busy 413 site_too_large

Commit the site into the branch folder and push

Parameters

{
  "commit": "9f0a12e…",
  "files": 42,
  "changed": true
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/git/push \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"message":"Update copy"}'

Errors: 409 repo_has_changes 409 mode_pull_only 403 push_denied 409 git_busy

Upload (or replace) one file

The request body is the raw file bytes (not multipart, not base64). {path} may contain slashes; URL-encode each segment. Send Content-Length when you can — oversize uploads are refused before any byte is stored.

Parameters

201 {
  "path": "css/site.css",
  "size": 5120,
  "contentType": "text/css; charset=utf-8",
  "homeFile": "index.html"
}

curl -s \
  -X PUT \
  --data-binary @css/site.css https://statichost.dev/api/v1/projects/29ufe/files/css/site.css \
  -H "Authorization: Bearer $KEY"

Errors: 400 invalid_path 413 site_too_large

Download one file (raw bytes)

Returns the file exactly as stored. For safety it is always sent as text/plain (text files) or application/octet-stream (everything else) with Content-Disposition: attachment; the real content type is in the X-File-Content-Type header. Use this to read a file before editing it.

Parameters

200 <the file bytes>   (X-File-Content-Type: text/html; charset=utf-8)

curl -s https://statichost.dev/api/v1/projects/29ufe/files/index.html \
  -H "Authorization: Bearer $KEY" -o index.html

Errors: 404 not_found

Delete one file

{
  "deleted": true
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe/files/old.html \
  -H "Authorization: Bearer $KEY"

Delete every file NOT in a keep-list (finish a re-deploy)

Parameters

{
  "keep": [
    "index.html",
    "css/site.css"
  ]
}

{
  "removed": [
    "old.html"
  ]
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/prune \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"keep":["index.html"]}'

Upload a whole site as one .zip

Body = the zip bytes. Every file in the zip is stored at its path inside the zip; a single top-level folder (e.g. dist/) is stripped automatically. Streams — the zip is never stored whole.

Parameters

{
  "uploaded": 12,
  "removed": [
    "old.html"
  ],
  "release": {
    "number": 8,
    "message": "Uploaded 12 files (zip)",
    "live": true,
    …
  },
  "project": {
    "id": "29ufe",
    …
  }
}

curl -s \
  -X PUT \
  --data-binary @site.zip "https://statichost.dev/api/v1/projects/29ufe/archive?replace=1" \
  -H "Authorization: Bearer $KEY"

Errors: 400 invalid_archive 413 site_too_large

Visitor login: state, page tree, rules and roles

available = the server can do visitor login; enabled = on for this site. tree lists every directory and page, rules the rules set (path → rule), roles each role with the paths that use it. authlock.ownerAccess is invited once you were invited to the AuthLock project.

{
  "available": true,
  "enabled": true,
  "tree": [
    {
      "path": "",
      "type": "dir"
    },
    {
      "path": "index.html",
      "type": "page"
    },
    {
      "path": "members/",
      "type": "dir"
    }
  ],
  "rules": {
    "members/": {
      "mode": "roles",
      "roles": [
        "members"
      ]
    }
  },
  "roles": [
    {
      "id": "…",
      "slug": "members",
      "name": "Members",
      "usedOn": [
        "members/"
      ]
    }
  ],
  "authlock": {
    "projectId": "…",
    "dashboardUrl": "https://authlock.eu/dashboard/projects/…",
    "ownerAccess": "invited",
    "origins": [
      "https://29ufe.statichost.dev"
    ]
  }
}

curl -s https://statichost.dev/api/v1/projects/29ufe/access \
  -H "Authorization: Bearer $KEY"

Errors: 404 site_auth_unavailable

Visitor login: turn it on (creates the site's AuthLock project)

First time: creates an AuthLock project for the site (email code + social sign-in, no passwords, optional 2FA), registers the site's origins and invites you as admin. Later: turns it back on with the same project, rules and visitors. Returns the same view as GET.

201 {
  "available": true,
  "enabled": true,
  "tree": [
    …
  ],
  "rules": {},
  "roles": [],
  "authlock": {
    …
  }
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/access \
  -H "Authorization: Bearer $KEY"

Errors: 404 site_auth_unavailable 429 rate_limited 502 authlock_error

Visitor login: turn it off

Every page is open again (the site password still applies). The AuthLock project, rules and roles are kept for when you turn it back on.

{
  "enabled": false
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe/access \
  -H "Authorization: Bearer $KEY"

Errors: 409 site_auth_off

Visitor login: set who may see which directory or page

Replaces all rules. Keys are paths from the page tree ("" = root, "dir/", "page.html"); values are {"mode":"anonymous"}, {"mode":"signed_in"}, {"mode":"roles","roles":[…]} or null (inherit). Unknown roles are created in AuthLock.

Parameters

{
  "rules": {
    "members/": {
      "mode": "roles",
      "roles": [
        "members"
      ]
    },
    "account.html": {
      "mode": "signed_in"
    }
  }
}

{
  "enabled": true,
  "rules": {
    …
  },
  "roles": [
    …
  ],
  …
}

curl -s \
  -X PUT https://statichost.dev/api/v1/projects/29ufe/access/rules \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"rules":{"members/":{"mode":"roles","roles":["members"]}}}'

Errors: 400 invalid_path 400 invalid_rule 409 site_auth_off

Visitor login: create a role

Parameters

{
  "slug": "staff",
  "name": "Staff"
}

201 {
  "id": "…",
  "slug": "staff",
  "name": "Staff"
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/access/roles \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"slug":"staff"}'

Errors: 400 invalid_role 409 site_auth_off

Visitor login: the site's visitors and their roles

{
  "users": [
    {
      "id": "usr_…",
      "email": "ada@example.com",
      "name": "Ada",
      "status": "active",
      "roles": [
        "members"
      ],
      "lastLoginAt": "…"
    }
  ]
}

curl -s https://statichost.dev/api/v1/projects/29ufe/access/users \
  -H "Authorization: Bearer $KEY"

Errors: 409 site_auth_off

Visitor login: set a visitor's roles

The visitor ends up with exactly these roles (unknown ones are created). Takes effect on their next page view within ~5 minutes.

Parameters

{
  "roles": [
    "members",
    "staff"
  ]
}

{
  "roles": [
    "members",
    "staff"
  ]
}

curl -s \
  -X PUT https://statichost.dev/api/v1/projects/29ufe/access/users/usr_123/roles \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"roles":["members"]}'

Errors: 404 not_found 409 site_auth_off

AI chat: is it available, and the conversation so far

The editor has an AI chat when the server is configured for it (enabled). messages is your conversation about this site (oldest first).

{
  "enabled": true,
  "messages": [
    {
      "role": "user",
      "text": "Make the header green",
      "at": "…"
    },
    {
      "role": "assistant",
      "text": "Changed the header… <statichost-file path="css/site.css">…</statichost-file>",
      "at": "…"
    }
  ]
}

curl -s https://statichost.dev/api/v1/projects/29ufe/ai \
  -H "Authorization: Bearer $KEY"

AI chat: send a message (reply streamed as Server-Sent Events)

Runs one turn of the site's AI assistant. The AI never writes to the site: it answers with complete-file blocks <statichost-file path="…">…</statichost-file> (and <statichost-delete path="…"/>) that the editor applies as unsaved edits — to apply them yourself, PUT each file. Send files (path → current content) for files the AI has not seen yet or that changed since its last turn; it remembers earlier ones. The stream carries session, status (workspace starting), text (the reply as it is written), tool, error and a final done event whose reply is the whole answer. Limited per user per day (429 rate_limited).

Parameters

{
  "message": "Add a contact section",
  "files": {
    "index.html": "<!doctype html>…"
  },
  "current": "index.html"
}

event: textdata: {
  "text":"Added a contact section…"
}event: donedata: {
  "turn":1,
  "status":"completed",
  "reply":"Added a contact section… <statichost-file path="index.html">…</statichost-file>"
}

curl -sN \
  -X POST https://statichost.dev/api/v1/projects/29ufe/ai/messages \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"message":"Make the header green"}'

Errors: 404 ai_disabled 400 invalid_message 413 context_too_large 429 rate_limited 402 ai_out_of_credits 502 ai_unavailable

AI chat: start over

Closes the AI session (its workspace) and forgets this site's conversation.

{
  "reset": true
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe/ai \
  -H "Authorization: Bearer $KEY"

Errors: 404 ai_disabled

List custom domains and their DNS verification state

{
  "domains": [
    {
      "domain": "www.example.com",
      "verified": false
    }
  ],
  "target": "29ufe.statichost.dev"
}

curl -s https://statichost.dev/api/v1/projects/29ufe/domains \
  -H "Authorization: Bearer $KEY"

Connect a custom domain (Pro)

Registers the domain and checks DNS immediately. Point CNAME <domain> → <id>.statichost.dev (or TXT _statichost.<domain> = <id> for an apex). Unverified domains are re-checked automatically when traffic arrives.

Parameters

{
  "domain": "www.example.com"
}

201 {
  "domain": "www.example.com",
  "verified": true
}

curl -s \
  -X POST https://statichost.dev/api/v1/projects/29ufe/domains \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"domain":"www.example.com"}'

Errors: 403 plan_required 400 invalid_domain 409 domain_taken

Disconnect a custom domain

{
  "deleted": true
}

curl -s \
  -X DELETE https://statichost.dev/api/v1/projects/29ufe/domains/www.example.com \
  -H "Authorization: Bearer $KEY"