- Create an automation client
Sites API (v1)
Use the Sites API for managing sites, site collections and languages in the XM Apps system.
This API lets you interact with:
- The Site Collection object. Use a site collection to group together related sites that share the same resources.
- The Site object. The site object is the core entity that represents a website in the customer portfolio.
- The Language object. The language object is used to manage the languages available to a tenant and site.
- The Job object. The job object is used to manage running background jobs.
Note the following:
- All API requests are made in your production environment.
For more information, see the official SitecoreAI developer documentation.
To authorize your requests, use environment automation client credentials and generate a JSON Web Token (JWT).
Note: To create client credentials, you must be an Organization Admin or Organization Owner.
- In the Sitecore Cloud Portal, open SitecoreAI Deploy.
- Click Credentials > Environment > Create credentials > Automation.
- Fill out the automation client details, then click Create.
- Copy the client ID and the client secret because you won't be able to view them again in SitecoreAI Deploy. You'll use them to request a JWT.
Run the following cURL command to request a JWT. Replace the placeholder values with your client ID and client secret.
curl -X POST 'https://auth.sitecorecloud.io/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id={YOUR_CLIENT_ID}' \
--data-urlencode 'client_secret={YOUR_CLIENT_SECRET}' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'audience=https://api.sitecorecloud.io'In the response, the access_token key contains the JWT:
{
"access_token": "{YOUR_JWT}",
"scope": "xmcloud.cm:admin",
"expires_in": 86400,
"token_type": "Bearer"
}The JWT expires in 24 hours. If your requests unexpectedly return a response with status 401 Unauthorized, request a new JWT by repeating this POST request.
We recommend that you cache the JWT for 24 hours to avoid repeating this POST request while the JWT is still valid.