API reference
Authentication and access
Choose the right boundary for public reads and protected operations.
Public reads need no token
GET /v1/public/institutions/content returns published content only. A site identifier selects the dataset; it is not a secret.
Authoring operations are protected
Portal routes such as /v1/portal/sites/… require authentication and are not public content APIs. Do not call them from public browser code or reuse a person’s session as an integration credential.
Self-service API keys, a general SDK and a public management API contract are not available today. Contact GovCMS to confirm authorized integration options.
Protect configuration
- Keep private credentials in server environment variables or a secret store.
- Never commit credentials or expose them in NEXT_PUBLIC_ variables.
- Use separate configuration for preview and production.
- Request credential rotation through the deployment owner.