Skip to content
managed.devdocs

API overview

The managed.dev public API is the programmatic surface for everything you can do in the dashboard — provision sites, push and promote environments, run scoped WP-CLI, trigger backups and malware scans, read observability, and receive signed webhooks — through scoped tokens and a single versioned contract. It is live at https://api.managed.dev/v1 with 149 operations.

What this is

Section titled “What this is”

Most platforms force a choice. Generic PaaS — the gold standard for developer experience — give you scoped tokens, one spec that generates SDKs and a Terraform provider, signed webhooks, idempotency, and published limits, but they deliberately won’t manage your plugins, cron jobs, content, or database. Managed-WP hosts will touch that application layer, but only bluntly — a bulk plugin update, a raw WP-CLI pipe — behind coarse, often unscoped, tokens.

managed.dev runs on the Managed.dev Forge Platform (Forge) — a product-aware PaaS for managed CMS. PaaS-grade developer experience is the floor, not the differentiator:

  • Scoped tokens. Least-privilege API keys with per-resource, per-action scopes, optional expiry, and revocation.
  • One spec → the tooling. A single OpenAPI document is the source of truth for the Go and TypeScript SDKs, the mf CLI, the Terraform provider, and the MCP server, with a zero-drift release gate. See SDKs, CLI & tooling.
  • Signed webhooks, idempotency, versioning, published limits — the table-stakes reliability features you’d expect from a Stripe or a Cloudflare.

The differentiator sits on top of that floor: deep, fine-grained, capability-discovered control of the dynamic application layer that generic PaaS won’t touch and WP hosts expose only crudely. Today that means scoped WP-CLI exec with a denylist for dangerous commands, cache purge, redirects, credential and magic-link issuance, and per-site PHP-version switching — with components Preview, content Preview, database Preview, and cron Preview endpoints designed and on the way. The clearest, most concrete win over every WP host is authorization granularity — you mint a key pinned to one site that can run one class of WP-CLI command there, and nothing else.

Base URL and versioning

Section titled “Base URL and versioning”

The API is served at:

Base URL
https://api.managed.dev/v1

Versioning follows the Stripe model, split across two axes:

  • URL-major (/v1). Breaking shape changes — a removed field, a renamed resource, an incompatible payload — bump the URL major. Within /v1, new fields and endpoints are additive, so you should ignore unknown fields rather than fail on them.
  • Dated Forge-Version header. Breaking behavior changes are pinned with a dated header so your integration’s behavior is frozen to the date you built against:
Pin a behavior version
GET /v1/sites HTTP/1.1
Host: api.managed.dev
Authorization: Bearer mfk_live_…
Forge-Version: 2026-06-23

The API is currently in developer preview: every response carries an X-Forge-Stability: preview header, meaning the whole surface may still change ahead of general availability. There are no per-endpoint stability tiers — the header describes the surface as a whole. See versioning for the full policy.

What this section covers

Section titled “What this section covers”

Resources

The endpoint reference, grouped by resource — sites, environments, deployments, domains, backups, observability, security, jobs, and the capability-gated application layer. Start at the resources overview.

A request looks like this

Section titled “A request looks like this”

Every authenticated call carries a bearer token and returns a consistent envelope — data plus a request_id you can quote in a support ticket:

List your sites
curl https://api.managed.dev/v1/sites \
  -H "Authorization: Bearer mfk_live_…" \
  -H "Forge-Version: 2026-06-23"
Response
{
  "data": [
    {
      "id": "site_01J7ZC3W9Q8F2K7M3N0XB5R4D2",
      "slug": "acme-store",
      "domain": "acme-store.com",
      "profile": "bedrock",
      "php_version": "8.3",
      "runtime": "wordpress",
      "region": "us-east",
      "status": "running",
      "created_at": "2026-05-01T12:00:00Z"
    }
  ],
  "pagination": { "next_cursor": null, "has_more": false },
  "request_id": "req_01J9F2K7M3N0XB5R4D2W9Q8F2K"
}

Mutations that aren’t instantaneous return a job you can poll or stream to completion — that pattern is the subject of the quickstart.

Next steps

Section titled “Next steps”
API quickstartMake your first request, then a worked async mutation, in a few minutes.
API keysThe credential families, prefixes, and how tokens map to a principal.
Resources overviewThe full object graph and the endpoint reference, grouped by resource.
SDKs, CLI & toolingGenerated SDKs, the mf CLI, the Terraform provider, and the MCP server.