Sites

Preview A site is the product-agnostic root of everything you deploy. It carries a runtime (wordpress, static, and — on the roadmap — drupal, node, and more), owns one or more environments, and advertises what it can do through capability discovery. A static site and a WordPress site are the same resource type — they differ only in their advertised capabilities.

Developer preview

The managed.dev public API is in active development. Endpoints, scopes, and payloads described here reflect the current design and may change before general availability.

The site object

Field	Type	Description
id	string	Stable identifier, e.g. site_01J7....
name	string	Display name.
runtime	string	wordpress, static, … — drives capability discovery.
runtime_version	string	Version of the runtime, e.g. 6.8.
profile	string	Build profile: bedrock, vanilla, or static.
php_version	string	PHP version for PHP runtimes (set at create).
project_id	string	The project this site belongs to.
team_id	string	The owning team.
production_env_id	string	Convenience pointer to the production environment.
status	string	active, provisioning, suspended.
created_at	string	RFC 3339 timestamp.

Create & retrieve a site

POST /v1/sites

sites:write Create a site. Provisioning is non-instant, so this returns a 202 Accepted with an async job and a Location header.

Parameter	Type	Required	Description
name	string	yes	Display name for the site.
runtime	string	yes	wordpress or static.
profile	string	yes	bedrock, vanilla, or static.
project_id	string	yes	Project to create the site in.
php_version	string	no	PHP version for PHP runtimes.

cURL

Create a WordPress site

curl -X POST https://api.managed.dev/v1/sites \
  -H "Authorization: Bearer mfk_live_..." \
  -H "Idempotency-Key: 4a7b...e2" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Store",
    "runtime": "wordpress",
    "profile": "bedrock",
    "project_id": "proj_01J6..."
  }'

Go

Create a WordPress site

job, err := client.Sites.Create(ctx, &forge.SiteCreateParams{
    Name:      forge.String("Acme Store"),
    Runtime:   forge.Runtime("wordpress"),
    Profile:   forge.Profile("bedrock"),
    ProjectID: forge.String("proj_01J6..."),
}, forge.WithIdempotencyKey("4a7b...e2"))

TypeScript

Create a WordPress site

const job = await client.sites.create(
  {
    name: "Acme Store",
    runtime: "wordpress",
    profile: "bedrock",
    project_id: "proj_01J6...",
  },
  { idempotencyKey: "4a7b...e2" },
);

mf CLI

Create a WordPress site

mf sites create --name "Acme Store" \
  --runtime wordpress --profile bedrock \
  --project proj_01J6...

Response (202 Accepted)

{
  "data": {
    "id": "job_01J9...",
    "type": "site.create",
    "status": "queued",
    "created_at": "2026-06-24T14:10:02Z",
    "resource": { "type": "site", "id": "site_01J7..." },
    "links": { "self": "/v1/jobs/job_01J9...", "stream": "/v1/jobs/job_01J9.../stream" }
  },
  "request_id": "req_01J9..."
}

GET /v1/sites/{id}

sites:read Retrieve a single site once provisioning completes.

Retrieve a site

curl https://api.managed.dev/v1/sites/site_01J7... \
  -H "Authorization: Bearer mfk_live_..."

Response

{
  "data": {
    "id": "site_01J7...",
    "name": "Acme Store",
    "runtime": "wordpress",
    "runtime_version": "6.8",
    "profile": "bedrock",
    "php_version": "8.3",
    "project_id": "proj_01J6...",
    "team_id": "team_01J6...",
    "production_env_id": "env_01J8...",
    "status": "active",
    "created_at": "2026-06-24T14:10:09Z"
  },
  "request_id": "req_01J9..."
}

Note

A site you can’t see returns 404, not 403 — existence hiding. A site you can see but lack the scope for returns 403 insufficient scope. See errors.

List, update & delete

• GET /v1/sites — sites:read list sites, cursor-paginated, filterable by ?project_id= and ?runtime=.
• PATCH /v1/sites/{id} — sites:write update mutable fields such as name and project_id.
• DELETE /v1/sites/{id} — sites:admin permanently delete a site; returns a 202 job.

Lifecycle actions

These act on the whole site and return a 202 job.

Endpoint	Scope	What it does
POST /v1/sites/{id}/restart	sites:write	Restart the runtime for every environment.
POST /v1/sites/{id}/transfer	sites:admin	Move ownership to another team or project.
POST /v1/sites/{id}/clone	sites:admin	Create a full copy of the site, including environments.

Restart a site

curl -X POST https://api.managed.dev/v1/sites/site_01J7.../restart \
  -H "Authorization: Bearer mfk_live_..." \
  -H "Idempotency-Key: 1f0c...77"

PII hard-cut on clone

A cloned site inherits the same fail-closed hard-cut floor as a cloned environment: observability on the clone never surfaces rows from before the clone. See environments.

Capabilities

GET /v1/sites/{id}/capabilities

sites:read Ask a site what it can do. Drive your client off this answer instead of branching on runtime — a static site reports components.plugins as supported: false, a WordPress site reports the actions it allows.

Discover a site's capabilities

curl https://api.managed.dev/v1/sites/site_01J7.../capabilities \
  -H "Authorization: Bearer mfk_live_..."

Response

{
  "data": {
    "runtime": "wordpress",
    "runtime_version": "6.8",
    "capabilities": {
      "components.plugins": { "supported": true, "actions": ["list","install","activate","update","delete"] },
      "components.themes":  { "supported": true, "actions": ["list","activate","update","delete"] },
      "database":           { "supported": true, "engine": "mysql" },
      "exec":               { "supported": true, "shells": ["wp-cli","bash"] },
      "clone_content":      { "supported": true, "selectors": ["db","files"] }
    }
  },
  "request_id": "req_01J9..."
}

See capability discovery for the two “no” semantics (404 when a capability is structurally absent, 409 capability.unsupported when the route exists but the runtime can’t perform it) and the static runtime catalog at GET /v1/runtimes.

Configuration

GET · PATCH /v1/sites/{id}/config

Read (sites:read) or update (sites:write) a site’s performance, WAF, and PHP configuration. Changing the PHP version or runtime tier needs the runtime:write scope and applies asynchronously via a job.

Parameter	Type	Required	Description
performance	object	no	Page-cache and object-cache tuning.
waf	object	no	WAF mode and rule toggles; see WAF.
php_version	string	no	Switch PHP version — requires runtime:write.

Read site config

curl https://api.managed.dev/v1/sites/site_01J7.../config \
  -H "Authorization: Bearer mfk_live_..."

Note

Most config lives per environment so a value can differ between staging and production. The site-level config endpoint sets defaults and is a convenience alias for the production environment. See config & secrets.

Next steps

EnvironmentsThe first-class children of a site: production, staging, and preview.

Capability discoveryHow a site advertises what it can do, so your client never hard-codes a runtime.

DeploymentsBuild, deploy, promote, and roll back code on a site's environments.