The Auto Blogger REST API lets trusted software manage websites, editorial settings, content topics, and webhook integrations on behalf of a signed-in user. It uses OAuth 2.0 bearer tokens and JSON over HTTPS.

Use this API when you are building:

• AI agents or internal tools that configure sites and enqueue topics
• Custom importers that sync published posts
• Automation that registers webhook endpoints (similar to the WordPress plugin)

Public feed URLs and inbound webhook deliveries are documented separately—they do not use this API:

• Content feeds — unlisted JSON/RSS URLs
• Webhooks (outbound) — payloads we POST to your server

#Base URL

All API routes live under:

https://auto-blogger.ai/api

Every request must use HTTPS.

#Quick start

1. Obtain an access token with the scopes your tool needs (see Authentication).
2. Call GET /api/me to confirm the token and see which account it acts as.
3. Call GET /api/websites to list sites, or POST /api/websites to add one.
4. Use PATCH /api/websites/{uuid} to change settings, or the content topics API to enqueue keywords.

Example (Bearer token):

curl -sS \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Accept: application/json" \
  https://auto-blogger.ai/api/me

#Authentication

Send the access token on every request:

Authorization: Bearer YOUR_ACCESS_TOKEN
Accept: application/json

Tokens are tied to a user and one of their workspace accounts. You only see and change websites that belong to that account. Another account’s website returns 403 Forbidden. A topic or integration ID that does not belong to the website in the URL returns 404 Not Found.

#How to get a token

WordPress plugin (recommended for WordPress sites)
The official plugin uses OAuth 2.0 with PKCE. It requests scopes websites:read and integrations:manage. See WordPress plugin for the user-facing flow.

Your own app can follow the same pattern:

1. GET /oauth/wordpress/oauth-config (public OAuth setup URL, not part of the authenticated API) returns oauth_client_id, connect paths, and redirect URI hints.
2. Send the user to /oauth/wordpress/connect with return_url, code_challenge, and code_challenge_method=S256.
3. After the user approves, exchange the authorization code at POST /oauth/token using your client credentials and PKCE verifier.

Agents and custom integrations
Request the scopes you need at authorization time (see below). Use the same OAuth authorization code flow with PKCE when building your own client. Access tokens are valid for 15 days; refresh tokens are valid for 30 days (then request a new token pair).

#Scopes

Read

Scope	Allows
websites:read	List/view websites and full settings payloads (also satisfies the other read scopes below when granted via OAuth)
content-topics:read	List/view content topics
published-posts:read	Published-post sync
integrations:read	List webhook integrations

Write

Scope	Allows
websites:write	Create, update, and delete websites and settings
content-topics:write	Create, update, and delete content topics
integrations:write	Create and delete webhook integrations

Legacy (OAuth clients only)

Scope	Allows
websites:manage	All read scopes plus websites:write, content-topics:write, and integrations:write
integrations:manage	Full REST API write access (WordPress plugin; includes websites:manage capabilities)

Workspace API tokens in the dashboard use the granular read/write scopes. OAuth flows may still request the legacy bundles; the API maps them to the same endpoint permissions.

Typical setups:

• Read-only monitoring: published-posts:read and/or content-topics:read
• Topic queue automation: content-topics:read + content-topics:write
• WordPress plugin (OAuth): websites:read + integrations:manage

#Rate limiting

Authenticated requests are limited to 60 requests per minute per access token. If you exceed the limit, the API returns 429 Too Many Requests. Retry after a short pause or spread calls over time.

Every /api/... route below requires a valid bearer token. The only unauthenticated routes on the API prefix are inbound webhooks (POST /api/webhook/...) used by external platforms—not the management API.

WordPress OAuth discovery lives at GET /oauth/wordpress/oauth-config (rate limited per IP).

#Response format

Successful responses are JSON. Collection endpoints wrap rows in a data key:

{
  "data": [ ... ]
}

Create operations often return 201 Created with a data object. Deletes return 204 No Content with an empty body.

Timestamps in API resources use ISO 8601 strings where present.

#Errors

HTTP status	Meaning
401	Missing or invalid token
403	Valid token but missing scope, wrong account, or policy denied (e.g. Writer role cannot manage integrations)
404	Website UUID unknown, or nested resource not found on that website
422	Validation failed — body includes message and field-specific errors
429	Rate limit exceeded
503	Optional feature unavailable (e.g. WordPress OAuth not configured)

Example validation error:

{
  "message": "The keyword field is required.",
  "errors": {
    "keyword": ["The keyword field is required."]
  }
}

#Account roles vs API

Authorization follows the same rules as the dashboard:

Action	Owner / Admin	Writer	Stakeholder
View websites, topics, published posts	Yes	Yes	Yes
Manage topic queue (API topics)	Yes	Yes	No
Change website settings, delete sites, manage webhook integrations	Yes	No	No

Writers receive 403 on website settings, integration writes, and website delete even when the token includes a manage scope. Stakeholders can use read endpoints only.

#Endpoint map

Detailed references:

Guide	Contents
Websites & settings	CRUD, full settings field reference, PATCH examples
Content topics	Topic queue CRUD, priority scoring, queue order
Integrations & sync	GET /api/me, webhooks API, published-post sync, OAuth config

#Summary table

Method	Path	Scope (read / write)
GET	/api/me	Auth only
GET	/api/websites	websites:read
POST	/api/websites	websites:manage or integrations:manage
GET	/api/websites/{uuid}	websites:read
PATCH	/api/websites/{uuid}	manage
DELETE	/api/websites/{uuid}	manage
GET	/api/websites/{uuid}/content-topics	websites:read
POST	/api/websites/{uuid}/content-topics	manage
GET/PATCH/DELETE	/api/websites/{uuid}/content-topics/{id}	read / manage
GET	/api/websites/{uuid}/published-posts	websites:read
GET/POST/DELETE	/api/websites/{uuid}/integrations	manage

{uuid} is the website’s public UUID (same value as in feed URLs and webhooks).

OAuth client discovery for the WordPress plugin: GET /oauth/wordpress/oauth-config (public, outside the authenticated API).

#Related guides

• WordPress plugin — OAuth connect and webhook registration
• Webhooks — payload shape for post.published (also returned by published-post sync)
• Troubleshooting — connection and delivery issues