CallPages Owner API — Guide for account owners & their robots

Version 1.0. Everything you can do in the owner dashboard, your robots can do by API — pages, products, the website editor, calls/activity (read), appointments, domains, and infrastructure status. Collections are edited as part of the page (PUT /api/pages/:id — see §4). The API accelerates robot work; the web interface remains fully available (dual-surface).

1. Create a key

1. Open the dashboard → Settings → API Keys.
2. Name the key (e.g. “Dilanny's web robot”) and pick a scope: read (GET only) or write (full write).
3. Copy the key — it starts with cp_live_ and is shown once. Only its hash is stored.

2. Authenticate

Send the key as a Bearer

curl https://callpages.me/api/me \
  -H "Authorization: Bearer " \

A key acts with your account's perimeter only: your pages, your customers, your data — never another account's. Key management itself (create/list/revoke) requires your signed-in browser session; a key can never mint keys.

3. Scopes

• read — GET/HEAD/OPTIONS on every owner endpoint. A write attempt returns 403 insufficient-scope.
• write — everything your dashboard session can do.

4. Robot flow: page → collection → product → website

# 1. Create a page
curl -X POST https://callpages.me/api/pages \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -d '{"slug":"my-shop","title":"My Shop","business_name":"My Shop"}'

# 2. Add products: POST /api/pages/:id/products (one at a time —
#    the anti-wipe pattern; collections live in the page config,
#    edited via PUT /api/pages/:id)
# 3. Edit the website: PUT /api/pages/:id/site-pages
# See the endpoint table below for exact paths and payloads.

5. Endpoint reference

6. Errors

• 401 unauthorized — missing/invalid key or session.
• 403 insufficient-scope — a read key tried to write.
• 403 — the target belongs to another account.
• 404 not-found — unknown id (every documented endpoint exists; a documented endpoint that 404s is a release-blocking bug).
• 429 — rate limited; back off.

7. Observability

Every key call is logged in Activity (which key, what action, which page) and counts toward the key's usage in Settings. Revoke a key instantly from Settings → API Keys if it leaks.

8. Rate limits

Sensible per-key limits inside Cloudflare's free tier; see GET /api/usage for your current consumption.

Guide version 1.0 · This guide is contract-tested in CI: every endpoint above must exist.