Overview
Endpoint behavior, authentication, filtering, errors, OpenAPI access, and client code generation.
Dyrected derives a REST API from the collections and globals in your dyrected.config.ts. Every collection gets list, read, create, update, and delete routes; every global gets read and update routes; and features such as auth, uploads, and workflows add their own routes when enabled.
Most JavaScript and TypeScript apps should use the SDK instead of calling REST directly. Reach for REST when you need a language the SDK does not cover, or when you are integrating from another system.
Base URL
Self-hosted routes live beneath your application origin:
https://example.com/apiThe SDK is configured with the origin before /api, because SDK methods add /api themselves.
Authentication
Depending on your access rules, requests carry a site API key, a user JWT, and — in Cloud mode — a site identifier.
| Credential | Header | Typical use |
|---|---|---|
| Site API key | x-api-key | Trusted server-to-server access |
| User JWT | Authorization: Bearer … | User-scoped and admin operations |
| Site ID | x-site-id | Cloud tenant selection |
An endpoint is public only when its access rule allows the operation.
Listing and filtering
Collection list routes accept limit (default 10, maximum 100), page, sort, depth, optional free-text search, and a JSON-encoded where object.
const query = new URLSearchParams({
limit: '10',
search: 'hello',
sort: '-createdAt',
depth: '1',
where: JSON.stringify({ status: { equals: 'published' } }),
})
const response = await fetch(`/api/collections/posts?${query}`)search runs on the backend against the collection's configured searchable fields, then combines with where using AND. That keeps free-text search aligned with access control, pagination, and any structured filters you already apply.
Operators include equals, not_equals, contains, starts_with, in, not_in, gt, gte, lt, lte, and exists. List responses use a shared pagination envelope with docs, total, limit, page, totalPages, hasNextPage, and hasPrevPage. Note that the limit parameter is capped at 100 for list operations to ensure performance and reliability.
Collection aggregations
Compute statistical totals, averages, counts, minimums, and maximums across a collection in a single request without loading documents:
POST /api/collections/:slug/aggregateSend a JSON object where each key maps to an aggregation operation:
curl -X POST https://example.com/api/collections/orders/aggregate \
-H "Content-Type: application/json" \
-H "x-api-key: your-api-key" \
-d '{
"totalOrders": { "count": "*" },
"totalRevenue": { "sum": "totalAmount" },
"avgPaid": { "avg": "totalAmount", "where": { "status": { "equals": "paid" } } }
}'Aggregations enforce collection access.read gates and inject any row-level tenant constraints automatically. For detailed syntax and type casting, see Aggregating Statistics.
Error responses
Use HTTP status codes as the primary error category: invalid input (400), missing credentials (401), denied access (403), missing resources (404), conflicts (409), oversized uploads (413), and unexpected failures (500). Do not blindly retry validation or authorization failures.
OpenAPI schema access
Every Dyrected project generates an OpenAPI document from its current content model:
GET /api/openapi.jsonUse the runtime document for client generation and validation, because it contains your actual collection slugs, fields, globals, uploads, and workflow routes. An interactive UI is available at GET /api/docs.
The documentation site also publishes a representative OpenAPI document built from a maximal fixture. It is useful for tooling tests and route discovery, but it is not your project's schema.
Generating a client
Point any OpenAPI code generator at your runtime document to produce a typed client in the language of your choice:
npx openapi-typescript https://example.com/api/openapi.json -o ./dyrected-api.d.tsRegenerate whenever the content contract changes. Do not treat an old downloaded specification as permanently compatible. For JavaScript and TypeScript, the SDK already gives you a typed client with no code generation step.
Generated endpoint inventory
The table below is generated from a representative maximal configuration so it can cover every route family. Your project exposes the subset of these routes that your own collections, globals, and features produce.
| Method | Path | Summary | Authentication |
|---|---|---|---|
| GET | /api/audit | Get audit entries across all readable audited collections | Required |
| GET | /api/collections/guest-responses | Find Guest Responses | Required |
| POST | /api/collections/guest-responses | Create Guest response | Required |
| DELETE | /api/collections/guest-responses/{id} | Delete Guest response | Required |
| GET | /api/collections/guest-responses/{id} | Get a single Guest response | Required |
| PATCH | /api/collections/guest-responses/{id} | Update Guest response | Required |
| POST | /api/collections/guest-responses/aggregate | Aggregate Guest Responses | Required |
| DELETE | /api/collections/guest-responses/delete-many | Delete multiple Guest Responses | Required |
| GET | /api/collections/media | Find Media | Required |
| POST | /api/collections/media | Create Media item | Required |
| DELETE | /api/collections/media/{id} | Delete Media item | Required |
| GET | /api/collections/media/{id} | Get a single Media item | Required |
| PATCH | /api/collections/media/{id} | Update Media item | Required |
| POST | /api/collections/media/aggregate | Aggregate Media | Required |
| DELETE | /api/collections/media/delete-many | Delete multiple Media | Required |
| GET | /api/collections/media/media | List Media | Required |
| POST | /api/collections/media/media | Upload Media item | Required |
| GET | /api/collections/media/media/{filename} | Serve Media item bytes | Public |
| GET | /api/collections/posts | Find Posts | Required |
| POST | /api/collections/posts | Create Post | Required |
| GET | /api/collections/posts/__audit | Get Post audit entries | Required |
| DELETE | /api/collections/posts/{id} | Delete Post | Required |
| GET | /api/collections/posts/{id} | Get a single Post | Required |
| PATCH | /api/collections/posts/{id} | Update Post | Required |
| POST | /api/collections/posts/{id}/transitions/{transition} | Transition Post workflow | Required |
| GET | /api/collections/posts/{id}/workflow-history | Get Post workflow history | Required |
| POST | /api/collections/posts/aggregate | Aggregate Posts | Required |
| DELETE | /api/collections/posts/delete-many | Delete multiple Posts | Required |
| GET | /api/collections/users | Find Users | Required |
| POST | /api/collections/users | Create User | Required |
| DELETE | /api/collections/users/{id} | Delete User | Required |
| GET | /api/collections/users/{id} | Get a single User | Required |
| PATCH | /api/collections/users/{id} | Update User | Required |
| POST | /api/collections/users/{id}/change-password | Change a User password | Required |
| POST | /api/collections/users/accept-invite | Accept an invitation | Public |
| POST | /api/collections/users/aggregate | Aggregate Users | Required |
| DELETE | /api/collections/users/delete-many | Delete multiple Users | Required |
| POST | /api/collections/users/first-user | Register the first User | Public |
| POST | /api/collections/users/forgot-password | Request a password reset | Public |
| GET | /api/collections/users/init | Get Users initialization state | Public |
| POST | /api/collections/users/invite | Invite a User | Required |
| POST | /api/collections/users/login | Log in to Users | Public |
| POST | /api/collections/users/logout | Log out of Users | Required |
| GET | /api/collections/users/me | Get the current User | Required |
| POST | /api/collections/users/refresh-token | Refresh an authentication token | Required |
| POST | /api/collections/users/reset-password | Reset a password | Public |
| GET | /api/docs | Open interactive API documentation | Public |
| GET | /api/dyrected/options/{collection}/{field} | Resolve dynamic field options | Required |
| GET | /api/globals/settings | Get Site settings | Required |
| PATCH | /api/globals/settings | Update Site settings | Required |
| GET | /api/media/{filename} | Serve a stored file | Public |
| GET | /api/openapi.json | Get the OpenAPI specification | Public |
| GET | /api/preferences/{key} | Get an authenticated user preference | Required |
| PUT | /api/preferences/{key} | Set an authenticated user preference | Required |
| GET | /api/preview-data | Resolve preview data from a token | Public |
| POST | /api/preview-token | Create a preview token | Required |
| GET | /api/schemas | Get the serialized Dyrected schema | Public |