Sitecore API catalog

Welcome to the Sitecore catalog of REST APIs. The REST API documentation in this catalog follows the OpenAPI specification and features an interface that enables authenticated users to send requests directly to their tenant. You can use this interactive console to authenticate, enter custom parameter values, send requests, and inspect responses. You can also download OpenAPI definition files straight from the documentation.

SitecoreAI

Agent API

The Agent API allows AI agents to take direct action in Sitecore through secure REST endpoints. It supports common digital experience tasks such as creating pages, adding components, and updating content. As part of Sitecore's interoperability approach, the Agent API allows agentic platforms and other connected systems to interact directly with Sitecore. When an AI agent receives a natural language request, it can call the appropriate Agent API endpoints to complete the task. For example, a request to create a new landing page might trigger an endpoint in Sitecore that automatically builds the page. If the AI agent performs an unintended action, you can use the job ID to revert it. Each operation is tracked to ensure safe rollback when needed. All Agent API actions follow the built-in security and approval rules in Sitecore, keeping work safe, traceable, and auditable. In addition to AI agent-driven workflows, developers can also use the REST API directly to interact with the following objects: Sites - retrieve and manage sites and their pages. Pages - create and manage pages and components. Content - create and organize content items. Components - retrieve and manage components and datasources. Assets - upload and manage digital assets. Environments - retrieve environment and language details. Personalization - manage personalized content variants. Jobs - view or revert job operations. Brand kits - retrieve brand kits and their details. Briefs - retrieve brief types, generate and create briefs. Experiments - create and update A/B tests on components on a page. Flow definitions - retrieve flow definitions (A/B/n tests and personalizations) for a page and set up their variants. Note the following: To use this REST API, you authenticate your API requests. All API requests are made in your production environment. The Agent API also powers the Sitecore Marketer MCP server, which uses these endpoints to perform agentic operations in Sitecore. Read more about the Marketer MCP server . Authorization To authorize your requests, use environment automation client credentials and generate a JSON Web Token (JWT). You can also register an OAuth app if your integration requires the OAuth 2.0 authorization code flow. Note: To create client credentials, you must be an Organization Admin or Organization Owner. Create an automation client In the Sitecore Cloud Portal, open SitecoreAI Deploy. Click Credentials > Environment > Create credentials > Automation . Fill out the automation client details, then click Create . Copy the client ID and the client secret because you won't be able to view them again in SitecoreAI Deploy. You'll use them to request a JWT. Register an OAuth app for the Agent API The Agent API uses the OAuth 2.0 authorization code flow to securely authenticate requests from external applications. Each application must have an OAuth app registration, which identifies the app and defines the parts of the Sitecore platform it can access. If you plan to register an OAuth app that uses the Agent API, you must submit a registration request to Sitecore Support and request the following scopes: xmcloud.cm:admin personalize.exp:mng personalize.tmpl:r personalize.pos:mng ai.org.bri:r co.briefs:r co.briefs:w ai.org.brd:r ai.org.bri:w cmp.sites:read platform.tenants:list Request a JWT Run the following cURL command to request a JWT. Replace the placeholder values with your client ID and client secret. curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id={YOUR_CLIENT_ID}' \ --data-urlencode 'client_secret={YOUR_CLIENT_SECRET}' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'audience=https://api.sitecorecloud.io' In the response, the access_token key contains the JWT: { "access_token": "{YOUR_JWT}", "scope": "xmcloud.cm:admin", "expires_in": 86400, "token_type": "Bearer" } The JWT expires in 24 hours. If your requests unexpectedly return a response with status 401 Unauthorized , request a new JWT by repeating this POST request. We recommend that you cache the JWT for 24 hours to avoid repeating this POST request while the JWT is still valid. Include the JWT in the request header You can now start making REST API requests. You must include the JWT in the request header of every request. For example: curl -X GET '{YOUR_BASE_URL}/...' \ -H 'Authorization: Bearer {YOUR_JWT}' \ -H 'Accept: application/json'

Content Transfer API

The Content Transfer REST API allows SitecoreAI Organization Admins and Organization Owners to initiate, monitor, and finalize content transfer operations for migrating content data from one SitecoreAI environment (the source ) to another (the destination ). This enables efficient transfer of data between environments using chunked data streaming with encryption and compression support. Each transfer operation includes at least one set of chunked data, where each chunk set represents a single data tree that was nominated for transfer. When an operation is complete, each of its chunk sets will be represented by a .raif file in the destination environment. To finish integrating the transferred data, use the separate Item Transfer API to have the destination database consume the .raif files. Note the following: To use this REST API, you must authorize your API requests. You must be an Organization Admin or Organization Owner to use this API. Different endpoints in this API are called against different environments. You will switch between a source base URL and a destination base URL depending on the step in the workflow. Each endpoint description specifies which environment to use. Migrating content Note: If you previously used the Package Designer for content migrations, review the differences between the designer and the modern API-based approach. The Content Transfer API covers the source side of a content migration. After completing the steps in this API, use the Item Transfer API to incorporate the transferred data into the destination database. Before you begin, ensure you have the Organization Admin or Organization Owner role, and that you have determined your source and destination base URLs and created a JWT for each environment. Create the transfer In your source environment, create a content transfer operation using a unique transfer ID of your choice. For each item you want to transfer, specify the item path, whether to include descendants, and how to handle conflicts with existing items in the destination. Depending on how much data is being transferred, the operation creates one or more chunk sets. Ensure that the item's parent chain already exists in the destination environment with the same item IDs. If it does not, the item will transfer successfully but will not appear in the content tree. To avoid this, transfer from a common ancestor using Scope: ItemAndDescendants , or transfer the parent items first. Wait for the transfer to be ready Poll the operation details in your source environment until State is Completed . If State is Failed , create a new transfer operation. For each chunk set in the response, record the ChunkSetId and ChunkCount because you'll need them to retrieve and save the chunks. Transfer chunks For each chunk set, repeat the following for every chunk in the set: In your source environment, retrieve the chunk . Make one request per chunk, using chunkId values 0 through ChunkCount - 1 . Note the IsMedia value from the Content-Disposition response header because you'll need it when saving the chunk. You can retrieve multiple chunks in parallel. In your destination environment, save the chunk , forwarding the binary stream exactly as received without modification. You can save chunks in parallel with retrieval, but every chunk must be saved before completing the chunk set. After all chunks in a set are saved, complete the chunk set in your destination environment. This generates a .raif file and returns its name. Record the name for use in the Item Transfer API. Repeat for every chunk set in the operation. Delete the transfer Delete the transfer operation from your source environment to clean up all associated resources. You can do this immediately after downloading all chunks from the source environment. Next steps Proceed to the Item Transfer API to incorporate the .raif files into the destination database. Base URL In the base URL, replace {host} with your environment host name. You need two base URLs: one for your source environment (where you're migrating data from) and one for your destination environment (where you're migrating data to). You will switch between them as you follow the migration workflow. Find the environment host name in SitecoreAI Deploy > Projects > your project > Authoring environments > your environment > Details > Environment host name . Example environment host name: your-environment.sitecorecloud.io Authorization To authorize your requests, use environment automation client credentials and generate a JSON Web Token (JWT). Note: To create client credentials, you must be an Organization Admin or Organization Owner . Create an automation client In the Sitecore Cloud Portal, open SitecoreAI Deploy. Click Credentials > Environment > Create credentials > Automation . Fill out the automation client details, then click Create . Copy the client ID and the client secret because you won't be able to view them again in SitecoreAI Deploy. You'll use them to request a JWT. Request a JWT Run the following cURL command to request a JWT. Replace the placeholder values with your client ID and client secret. curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id={YOUR_CLIENT_ID}' \ --data-urlencode 'client_secret={YOUR_CLIENT_SECRET}' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'audience=https://api.sitecorecloud.io' The JWT expires in 24 hours. If your requests unexpectedly return a response with status 403 Forbidden , request a new JWT by repeating this POST request. We recommend that you cache the JWT for 24 hours to avoid repeating this POST request while the JWT is still valid. Include the JWT in the request header You can now start making REST API requests. You must include the JWT in the request header of every request. For example: curl -X GET '{YOUR_BASE_URL}/...' \ -H 'Authorization: Bearer {YOUR_JWT}' \ -H 'Accept: application/json'

Item Transfer API

The Item Transfer API allows SitecoreAI Organization Admins and Organization Owners to incorporate special files ( sources ) containing migrated content and media data into the database of the destination environment. The Item Transfer API is primarily used to consume .raif files produced by the Content Transfer API . In this primary workflow, source files are read from Azure Blob Storage. Alternatively, you can use the Item Transfer API to upload small .raif files (under 100 MB) from your Sitecore file system, but this is a secondary workflow intended for smaller or ad hoc transfers. For large content migrations between environments, use the Content Transfer API to generate .raif files via chunked streaming, and then consume them using the Item Transfer API. Each .raif file represents a single data tree from the source environment, and each tree is either a single item or an item plus all of its descendants. Note the following: To use this REST API, you must authorize your API requests. You must be an Organization Admin or Organization Owner to use this API. Unlike the Content Transfer API, the Item Transfer API is used only in your destination environment, not in your source environment. Migrating content The Item Transfer API covers the destination side of a content migration. Before using this API, complete all steps in the Content Transfer API to generate .raif files in the destination environment. Also ensure you have the Organization Admin or Organization Owner role, and that you have determined your destination base URL and created a JWT for the environment. Verify the blob is available Return the list of available blob sources to confirm that the .raif file produced by the Content Transfer API is present and has a BlobState of Uploaded , which means that the file is ready to consume. Start consuming the blob Start consuming the source into the destination database, passing the .raif file name as the blobName parameter. Transferred items are immediately available to work with in the destination environment while the system completes the sync to the database in the background. The location response header contains a URL. The final path segment of the URL is the transfer ID used in subsequent requests. Monitor the transfer Although items are available immediately, poll the transfer status to detect failures. If the background sync fails before completing, items that were not yet synced will become unavailable and the transfer must be retried. Poll the transfer status until TransferState is Finished . If TransferState is Failed , retry the transfer . If BlobState is TransferredWithErrors , this is a terminal state indicating a partial success. To investigate, retrieve the transfer details and review the ValidationErrors list. You can also retrieve the details of a specific transfer or view the transfer history . Clean up After the transfer is finished, delete the blob source to remove the .raif file from Azure Blob Storage. This completes the migration process. Base URL In the base URL, replace {host} with your environment host name of your destination environment (where you're migrating data to). Find the environment host name in SitecoreAI Deploy > Projects > your project > Authoring environments > your environment > Details > Environment host name . Example environment host name: your-environment.sitecorecloud.io Authorization To authorize your requests, use environment automation client credentials and generate a JSON Web Token (JWT). Note: To create client credentials, you must be an Organization Admin or Organization Owner . Create an automation client In the Sitecore Cloud Portal, open SitecoreAI Deploy. Click Credentials > Environment > Create credentials > Automation . Fill out the automation client details, then click Create . Copy the client ID and the client secret because you won't be able to view them again in SitecoreAI Deploy. You'll use them to request a JWT. Request a JWT Run the following cURL command to request a JWT. Replace the placeholder values with your client ID and client secret. curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id={YOUR_CLIENT_ID}' \ --data-urlencode 'client_secret={YOUR_CLIENT_SECRET}' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'audience=https://api.sitecorecloud.io' The JWT expires in 24 hours. If your requests unexpectedly return a response with status 403 Forbidden , request a new JWT by repeating this POST request. We recommend that you cache the JWT for 24 hours to avoid repeating this POST request while the JWT is still valid. Include the JWT in the request header You can now start making REST API requests. You must include the JWT in the request header of every request. For example: curl -X GET '{YOUR_BASE_URL}/...' \ -H 'Authorization: Bearer {YOUR_JWT}' \ -H 'Accept: application/json'

Pages API

Use the Pages API for managing your site pages in SitecoreAI. This API lets you interact with your pages, including: Creating, updating, retrieving, and deleting pages. Retrieving versions and variants. Update layouts. Note the following: All API requests are made in your production environment. For more information, see the official SitecoreAI developer documentation . Authorization To authorize your requests, use environment automation client credentials and generate a JSON Web Token (JWT). Note: To create client credentials, you must be an Organization Admin or Organization Owner. Create an automation client In the Sitecore Cloud Portal, open SitecoreAI Deploy. Click Credentials > Environment > Create credentials > Automation . Fill out the automation client details, then click Create . Copy the client ID and the client secret because you won't be able to view them again in SitecoreAI Deploy. You'll use them to request a JWT. Request a JWT Run the following cURL command to request a JWT. Replace the placeholder values with your client ID and client secret. curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id={YOUR_CLIENT_ID}' \ --data-urlencode 'client_secret={YOUR_CLIENT_SECRET}' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'audience=https://api.sitecorecloud.io' In the response, the access_token key contains the JWT: { "access_token": "{YOUR_JWT}", "scope": "xmcloud.cm:admin", "expires_in": 86400, "token_type": "Bearer" } The JWT expires in 24 hours. If your requests unexpectedly return a response with status 401 Unauthorized , request a new JWT by repeating this POST request. We recommend that you cache the JWT for 24 hours to avoid repeating this POST request while the JWT is still valid. Include the JWT in the request header You can now start making REST API requests. You must include the JWT in the request header of every request. For example: curl -X GET '{YOUR_BASE_URL}/...' \ -H 'Authorization: Bearer {YOUR_JWT}' \ -H 'Accept: application/json'

Publishing API

Use the XM Cloud Publishing API to manage publishing jobs for a specific XM Cloud tenant. This API lets you create new publishing jobs, list both running and completed publishing jobs, and retrieve statistics about the publishing jobs of an XM Cloud tenant. Authentication To use the Publishing API, you need a JWT token requested using an automation client . This is sent with every request. To use publishing endpoints, your token must include the required scopes.

Sites API

Use the Sites API for managing sites, site collections and languages in the XM Apps system. This API lets you interact with: The Site Collection object. Use a site collection to group together related sites that share the same resources. The Site object. The site object is the core entity that represents a website in the customer portfolio. The Language object. The language object is used to manage the languages available to a tenant and site. The Job object. The job object is used to manage running background jobs. Note the following: All API requests are made in your production environment. For more information, see the official SitecoreAI developer documentation . Authorization To authorize your requests, use environment automation client credentials and generate a JSON Web Token (JWT). Note: To create client credentials, you must be an Organization Admin or Organization Owner. Create an automation client In the Sitecore Cloud Portal, open SitecoreAI Deploy. Click Credentials > Environment > Create credentials > Automation . Fill out the automation client details, then click Create . Copy the client ID and the client secret because you won't be able to view them again in SitecoreAI Deploy. You'll use them to request a JWT. Request a JWT Run the following cURL command to request a JWT. Replace the placeholder values with your client ID and client secret. curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id={YOUR_CLIENT_ID}' \ --data-urlencode 'client_secret={YOUR_CLIENT_SECRET}' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'audience=https://api.sitecorecloud.io' In the response, the access_token key contains the JWT: { "access_token": "{YOUR_JWT}", "scope": "xmcloud.cm:admin", "expires_in": 86400, "token_type": "Bearer" } The JWT expires in 24 hours. If your requests unexpectedly return a response with status 401 Unauthorized , request a new JWT by repeating this POST request. We recommend that you cache the JWT for 24 hours to avoid repeating this POST request while the JWT is still valid. Include the JWT in the request header You can now start making REST API requests. You must include the JWT in the request header of every request. For example: curl -X GET '{YOUR_BASE_URL}/...' \ -H 'Authorization: Bearer {YOUR_JWT}' \ -H 'Accept: application/json'