> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sandywp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Reference overview

> Use SandyWP's complete supported customer API for sandbox, reusable, import, workspace, account, and OAuth automation.

The SandyWP HTTP API is available at `https://app.sandywp.com`. The generated endpoint pages in this group are the complete supported customer API contract, rather than a list of every route hosted by the application.

## Authentication

Use a personal API key as a bearer token for normal automation. Create, label, and revoke keys with the account token endpoints or through the dashboard and CLI.

```http theme={null}
Authorization: Bearer $SANDYWP_TOKEN
```

Scoped OAuth tokens are intentionally narrower. They can call `GET /api/account/me` and the Imports family only, with `import:read` or `import:write` as appropriate; the other generated REST operations reject them. See [OAuth connector flow](/api-reference/oauth) for public-client registration and PKCE exchange guidance.

## Requests, async work, and errors

Send JSON on standard write requests with `Content-Type: application/json`. Archive chunks use `application/octet-stream`; Blueprint and plugin ZIP uploads use `multipart/form-data` where the endpoint says so.

Provisioning, imports, deployments, snapshots, and Blueprint runs are asynchronous. A response can include a job or run record, or a resource in a non-terminal state such as `creating`, `building`, `pending`, or `running`; poll the documented GET endpoint until it settles.

Errors use a JSON envelope. Check `error.code` for programmatic handling and treat `message` as display text.

```json theme={null}
{
  "error": {
    "code": "invalid_request",
    "message": "Explain what needs to change."
  }
}
```

## Included API families

The OpenAPI generator covers Templates, Sites and their tools, Blueprints, Imports, Workspaces, account identity/usage/tokens/SSH keys, and the OAuth registration and token-exchange contracts. The focused pages below add workflow guidance to the generated endpoint details.

<CardGroup>
  <Card title="Blueprint workflows" href="/api-reference/blueprints">
    Validate, save, run, and bake reviewable WordPress build recipes.
  </Card>

  <Card title="Import workflows" href="/api-reference/imports">
    Clone a live site or push a local WordPress archive.
  </Card>

  <Card title="Workspace workflows" href="/api-reference/workspaces">
    Select workspaces and manage members and roles.
  </Card>

  <Card title="OAuth connector flow" href="/api-reference/oauth">
    Register a public client and exchange a PKCE authorization code.
  </Card>
</CardGroup>

## Exclusions ledger

These hosted routes are intentionally outside the customer developer contract. They are browser backends, provider callbacks, public launch handlers, or operations interfaces—not undocumented alternatives to the generated endpoints.

| Excluded routes                                                                                | Why they are not in this API reference                                                       |
| ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `POST /api/sites`                                                                              | Guest/launcher browser backend. Use authenticated `/api/app/sites` for supported automation. |
| Account profile, avatar, password, support, and GitHub UI handlers                             | Dashboard workflows, not developer API contracts.                                            |
| Billing checkout, portal, and sync                                                             | Browser billing flows.                                                                       |
| Public launch routes                                                                           | Visitor-facing demo flow, not owner automation.                                              |
| Plugin/theme search proxies, storage, activity, newsletter, health, metrics, and impersonation | Proxies, telemetry, or unsupported developer surfaces.                                       |
| Slack/GitHub callbacks and Git/Polar webhooks                                                  | Provider callback and webhook receivers.                                                     |
| All `/api/admin/**` and `/api/internal/**` routes                                              | Privileged administration, worker lifecycle, and SSH-control interfaces.                     |

<Note>
  The published `mintlify-docs/openapi.yaml` is intentionally byte-for-byte equal to the repository-root `openapi.yaml`. Automated checks reject drift between them.
</Note>