Published content API and webhooks
Read approved public content from a trusted server and understand connected-provider webhook behavior.
Public content API
A versioned API can expose approved published content to authenticated consumers. Requests use the route's API-key authentication and never make unapproved drafts public.
Use it for a controlled content consumer, not for administrative access to the full venture workspace.
Read endpoints
| Method | Route | Behavior |
|---|---|---|
GET | /api/v1/published-content | Lists the newest visible content; optionally filter with type. |
GET | /api/v1/published-content?feed=true | Returns the uncapped visible set for feed generation. |
GET | /api/v1/published-content/{slug} | Returns one visible content payload or 404. |
GET | /api/v1/published-content/sitemap-entries | Returns the minimal public index used for sitemap generation. |
Send a read-scoped key as a Bearer token:
curl --fail-with-body \
-H "Authorization: Bearer $ORGAN_PUBLISHED_CONTENT_KEY" \
"https://your-organ-host.example/api/v1/published-content?type=blog_post"The list response is { "items": [...] }; dates are ISO 8601 strings on the wire. Missing or invalid tokens return 401. A correctly shaped request returns 403 when the server has no key configured for the required scope.
Loading diagram...
Do not expose the key in browser JavaScript, public environment variables, analytics, or logs. Call the API from a trusted server-side consumer and rotate server configuration when a key is replaced.
Webhooks
Webhook endpoints receive signed events from configured providers such as billing, source control, or project management. Each route validates its provider-specific signature or secret.
Treat webhook acceptance and business processing as separate stages: a valid signature proves provider authenticity, while idempotency, tenant resolution, payload validation, and asynchronous processing determine whether an event changes product state. Preserve the provider event ID when investigating duplicates.
For agent actions, see Agent tool access (MCP). That guide explains the customer-visible permission model; it is not a public client-integration contract.