Authentication contract

Send an API key as Authorization: Bearer gsc_.... The account owner or an admin creates keys in the Getsitecontrol admin, under API keys. A key grants a level (none, view, edit, full) in each section (widgets, emails, contacts), for one site or for every site of the account, and works until it expires or is revoked there.

An app connected through OAuth sends its access token (gscu_...) the same way. A token acts as its user, with the user’s current rights; it stops working when the user disconnects the app under Connected apps in their profile, when the password changes or when the user or the account is blocked. The authorization server (OAuth 2.1 with PKCE) is described at https://api.getsitecontrol.com/.well-known/oauth-authorization-server/v1/oauth. GET /v1/auth/me tells which user and account a token belongs to; DELETE /v1/auth/token revokes the token of the request.

An unknown or revoked key or token is 401 invalid_token; a missing one is 401 unauthenticated with WWW-Authenticate: Bearer. A level too low for the call is 403 forbidden, with the permission it needs in metadata.permission. A site outside the account is 404 site_not_found.

What follows describes the operations on resources; this reference itself needs no credential.

---

Source: OpenAPI specification. Paths that start with /v1 are on https://api.getsitecontrol.com.