Resource reference

This section documents every resource the managed.dev /v1 API exposes — what each object looks like, the endpoints that act on it, the scopes those endpoints require, and worked request/response examples. Read it alongside the core concepts, which cover the cross-cutting behavior (auth, errors, pagination, jobs) that every resource shares.

How the reference is organized

The API is split into two layers, and the split is deliberate.

• A product-agnostic core — fully shipped. account, teams, sites, environments, deployments, backups, functions, observability, security, events, and jobs are defined without reference to any CMS. A static site and a WordPress site are the same resource types — they differ only in the capabilities they advertise. These pages are stable across every runtime.
• A capability-gated dynamic application layer — partially shipped. This is the layer that reaches into the running application, and it lands piece by piece. Exec (WP-CLI as streaming jobs), cache purge, redirects, and the credential endpoints are live today. components (plugins, themes), content, and database are designed but not yet available — their pages carry a Preview badge. Which of these a given site supports depends on its runtime — you ask the site what it can do rather than hard-coding if runtime == "wordpress".

This page indexes both. The application-layer pages carry the same anatomy, with one extra element: a capability gate.

The per-endpoint anatomy

Every endpoint on every resource page is documented the same way, so you can scan it quickly:

1. The HTTP method and path, as a heading or inline code — for example POST /v1/sites or GET /v1/sites/{siteID}/capabilities.
2. The required scope(s), shown as a badge — for example sites:write. Remember write implies read and admin implies write, so a narrower badge is always sufficient.
3. Any capability gate, shown as an aside — for example “requires the components.plugins capability”. Endpoints in the core layer have no gate; only the application layer does.
4. A parameters table — name, type, required, and a one-line description for each path, query, and body field.
5. Request and response examples in tabs — at minimum cURL plus the Go SDK or the mf CLI, every response wrapped in the standard envelope.

Reading scope badges

A badge like environments:write means the endpoint needs at least that scope. The effective permission for any call is the intersection of your role, your key’s scopes, and your key’s resource constraint — see the security model.

The resource convention

Most resources follow the same shape, so once you’ve learned one you’ve learned them all:

Verb	Method + path	Returns
create	POST /v1/{collection}	the new object, or a 202 job for non-instant creates
retrieve	GET /v1/{collection}/{id}	a single object
update	PATCH /v1/{collection}/{id}	the updated object, or a 202 job
list	GET /v1/{collection}	a cursor-paginated collection
delete	DELETE /v1/{collection}/{id}	204, or a 202 job for non-instant deletes

Action endpoints — restart, promote, refresh, restore, and the like — sit under the resource they act on (POST /v1/sites/{siteID}/restart) and almost always return a 202 Accepted with an async job you track to completion.

The resources

Account & teams

Your account, teams, members and roles, projects, invites, audit feeds, and plan usage. Read more

Sites

The product-agnostic site resource — create, configure, restart, switch PHP versions, manage redirects, transfer, and discover what a site can do. Read more

Environments

First-class children of a site: staging and branch previews, with the full refresh / reset / push / suspend / resume lifecycle. Read more

Deployments

Builds, deployments, artifacts, releases, promotes, and rollbacks across environments. Read more

Functions

Wasm functions attached to a site — create from single-file source, build, deploy, and roll back on an isolated functions node. Read more

Backups & snapshots

Take snapshots, restore them, and read the account-wide backup status rollup. Read more

Observability

Performance summaries, timeseries, logs, traces, and requests — per site and per environment. Read more

Security

Vulnerability findings, malware scans, and detections. Read more

Jobs

The async-job resource that long-running mutations return. Read more

Notifications & events

The lifecycle event feed, in-app notifications with read state, and per-category email preferences. Read more

Access

SSH keys, SFTP / SSH / database credentials, admin-password reset, and one-time magic links into wp-admin — endpoints under /v1/sites/{siteID}, gated by the isolated credentials:read / credentials:write scopes that no wildcard ever grants.

Exec

Run scoped WP-CLI commands inside an environment as streaming jobs. Read more

Cache & secrets

Purge an environment’s page cache — all, by URL, or by tag. Env-scoped secrets management is still Preview. Read more

Domains, DNS & TLS

TLS certificate status is live at GET /v1/sites/{siteID}/tls; custom-domain and DNS management endpoints are Preview. Read more

Components

Preview The capability-gated plugin and theme layer. Read more

Content

Preview Posts, pages, media, and users on runtimes that support them. Read more

Database

Preview Schema, read queries, and exports for runtimes with a managed database. Read more

API keys

Mint, list, roll, and revoke the keys that authenticate every call. Read more

Next steps

Async jobsHow non-instant mutations return a job you poll or stream to completion.

Scope catalogThe full resource:action grammar and every scope you can grant.

Capability discoveryHow a site advertises what it can do, so your client never hard-codes a runtime.

API quickstartMake your first authenticated call in a few minutes.