# Volubit CMS API Documentation > **Base URL:** `/api` (e.g., `https://api.volubit.io/api`) > > **API Version:** v1 > > **Date:** August 2026 --- ## Table of Contents 1. [Conventions](#1-conventions) 2. [Public API](#2-public-api) 3. [Auth API](#3-auth-api) 4. [Admin API](#4-admin-api) 5. [Data Models](#5-data-models) 6. [Block Types & Pages](#6-block-types--pages) 7. [Webhooks](#7-webhooks) 8. [Environment Variables](#8-environment-variables) 9. [FE Integration Guide](#9-fe-integration-guide) --- ## 1. Conventions ### 1.1 Response Envelope **Success:** ```json { "success": true, "data": { ... } } ``` **Success with pagination:** ```json { "success": true, "data": [ ... ], "meta": { "current_page": 1, "per_page": 10, "total": 25, "last_page": 3 } } ``` **Cached response (public endpoints only):** ```json { "success": true, "data": { ... }, "cachedAt": "2026-08-23T10:00:00+07:00" } ``` **Error:** ```json { "success": false, "error": { "code": "NOT_FOUND", "message": "Resource not found." } } ``` **Validation error (422):** ```json { "message": "The given data was invalid.", "errors": { "email": ["The email field is required."], "password": ["The password must be at least 8 characters."] } } ``` ### 1.2 Authentication Three auth mechanisms depending on the route group: | Route Group | Auth Method | How to Pass | | -------------------------- | -------------------------- | ------------------------------- | | Public API | None | — | | Auth API (`/api/auth/*`) | Session-based (`auth:web`) | Session cookie (CSRF protected) | | Admin API (`/api/admin/*`) | Static API Token | `X-Api-Token` request header | **Admin API token** is configured via the `CMS_ADMIN_API_TOKEN` env var. > **Note:** The admin middleware currently authenticates as the first active `AdminUser` found in the database (shared token model). Per-user audit attribution uses that user's ID. ### 1.3 Rate Limiting | Throttle | Limit | Key | | ------------ | ----------- | ------ | | `public-api` | 60 req/min | per IP | | `admin-api` | 300 req/min | per IP | | `auth-login` | 10 req/min | per IP | Returns `429 Too Many Requests` with a `Retry-After` header when exceeded. ### 1.4 Content Cache Public endpoints cache responses for **5 minutes** (300 seconds). Cached responses include a `cachedAt` ISO timestamp. Cache is stored in the file store (`bootstrap/cache/data/`). ### 1.5 HTML Sanitization All HTML in `ContentBlock.data`, `Article.content`, and `Article.excerpt` is sanitized server-side before output. Only these tags are preserved: ```

,
, , , , , , ,