OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Payload CMS API Keys

Revoke a CMS API key

  • Sandbox: available
  • Staging: available
  • Production: unknown
DELETE
/v1/cms/api-keys/{id}

Revokes one of your current project's CMS API keys. Public delivery stops taking it at once.

Auth: bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. Scope: the caller's project (from the token).

Behaviour

  • id is a key's id from GET /v1/cms/api-keys; default revokes the default key.
  • A key the project does not hold returns 404 CMS_API_KEY_NOT_FOUND.
  • A 409 means the project changed while the server wrote. Retry.
  • Public responses a CDN already cached may still be served for up to a minute.
  • The answer is 204.

Example

curl -X DELETE 'https://api.sandbox.ovok.com/v1/cms/api-keys/default' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Authorization

bearer
headerAuthorizationBearer <JWT>

Path Parameters

id*string

Response Body

The key is revoked.

Example Request
curl -X DELETE 'https://api.sandbox.ovok.com/v1/cms/api-keys/string'
Example Response
Empty

Create a CMS API key POST

Creates an API key for public CMS delivery (`/v1/public/cms/...`) of your current project's tenant. The answer carries the key itself, once: it is stored only as a hash and cannot be shown again. **Auth:** bearer token of a project admin. The caller must also be a Practitioner, an admin or hold the System Owner access policy. **Scope:** the caller's project (from the token). ## Behaviour - `name` is 1 to 64 characters, trimmed. - The key starts with `ovok_cms_`. Send it as `x-api-key`, `Authorization: Bearer` or `?apiKey=`, with the tenant it belongs to (`x-ovok-tenant-code`, `?tenant=`, `x-ovok-medplum-project-id` or `?projectId=`). Naming another project's tenant answers 401. - A project holds at most 20 keys, the default key included: one more returns 409 `CMS_API_KEY_LIMIT`. - A 409 without a code means the project changed while the server wrote. Retry. - The answer is 201. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/cms/api-keys' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "name": "Marketing site" }' ```

List published documents of a public collection GET

Lists the published documents of a CMS collection for one tenant, in one language, one page at a time. Use it to show content such as release notes or articles in an app or website. **Auth:** one of the following, checked in this order: - The CMS public API key, in the `x-api-key` header, as `Authorization: Bearer <key>`, or as the `apiKey` query parameter. - No key, for collections configured as keyless (by default `legal-pages` and `translations`). - A signed-in Ovok session (bearer token), which may only read its own tenant. **Scope:** the tenant you name, by tenant code (`x-ovok-tenant-code` header or `tenant` query parameter) or by project id (`x-ovok-medplum-project-id` header or `projectId` query parameter). Headers win over query parameters, and a tenant code wins over a project id. If you name neither, a signed-in session reads its own tenant. Each Ovok deployment has one set of content; there is no environment to choose. ## Behaviour - Any collection except the `users` and `tenants` system collections can be read. - Only documents with status `published` are returned. The response is the CMS list envelope (`docs`, `totalDocs`, `page`, `limit`, and so on). - `locale` is a language tag such as `de` or `en-US`. Without it, the CMS default locale is used. Missing translations fall back as configured in the CMS. - `page` defaults to `1` and is limited to 1 to 100. `limit` defaults to `20` and is limited to 1 to 50. Values outside those ranges are clamped; values that are not whole numbers fall back to the default. - `sort` is a top-level field name, optionally prefixed with `-` for descending order, for example `-publishedAt`. Without it, the CMS default order is used. - Ovok also has a shared tenant whose published documents are added to every tenant's list. Where both have a document with the same `slug`, the tenant's own document wins. If either tenant has more than 200 published documents in the collection, only the tenant's own documents are returned. - Responses are cached by Ovok for up to 60 seconds. A request that names a tenant gets `Cache-Control: public, s-maxage=60, stale-while-revalidate=300` and a `Vary` on the tenant and API key headers. A request that names no tenant gets `Cache-Control: no-store`. Error responses carry neither. ## Example ```bash curl -X GET 'https://api.sandbox.ovok.com/v1/public/cms/collections/release-notes/items?tenant=my-medical-project&locale=de&sort=-publishedAt&limit=10' \ -H 'x-api-key: <cms public api key>' ```