MooverApp Tenant API
MooverApp Tenant API
Everything a site is made of, as an API: accounts and projects, websites and the domains they answer on, pages, blocks, menus, blog, media, themes, views and settings. This is the surface the MooverApp admin itself is written against — there is no capability behind it that the UI has and a client does not.
The semantics are AIP over plain REST/JSON: five standard methods on named resources, snake_case bodies, page_size/page_token/order_by/filter on every list, google.rpc.Status errors, etag + If-Match for concurrency, and an Operation to poll whenever the work outlives the call. Authenticate with POST /tenant-api/v1/users:authenticate and send the JWT as Authorization: Bearer <token>.
Tags
Account
The account a tenant signs in to. It owns the projects, and every website hangs off one of them.
Project
A grouping of websites inside one account — the parent a website is created under.
Website
The unit the platform publishes. Creating one starts provisioning and answers with an Operation to poll (§17);
code is immutable because the platform hostname is built from it.Custom Domain
A read-only projection of where a website answers: platform hostname, connection status, and the record
:verify checks. The domain itself is written through the general.web.custom_domain setting.CMS Page
Pages of the site — title,
url_key, rich-text content and SEO metadata. An empty visible_view_ids means every view, not none.CMS Page View
The per-view overlay of one page: what that view says instead of the master. A field counts as overridden only while its name is in
overridden.CMS Page Group
The versions of one page for customer groups: what a signed-in customer of the group reads instead of the page — a price, a condition, a hero. The group with the highest
priority wins; everybody else reads the page.CMS Block
Reusable fragments of content, addressed by
identifier and pulled into pages, themes and smart links.CMS Block View
The per-view overlay of one block: its content in that view.
Navigation
Menus and their items — nesting and order through
:move, plus the per-view overlay of a single item’s title, URL and visibility.Email Template
The subject and text of the emails a website sends — the contact form’s notification today — as plain text with
{{placeholders}}, plus the per-view overlay that says it in another view’s language. The platform creates the default template of each kind; it can be edited, not deleted.Blog
Posts, categories, tags and authors, each with a per-view overlay of its own. Categories form a tree reordered with
:move, and :set_posts replaces the posts of one category in a single call.Editorial
The publication rules of one website, the backlog of what it means to write about, and the rolling calendar that turns the two into dated drafts.
editorial_plan is a singleton that always exists, :refill fills the calendar on demand, and a slot becomes a post with :materialize and goes live with :publish.Editorial AI
The desk writing its own drafts: the policy that names which of the account’s AI agents write, review and translate, and the generation — one run of the pipeline for one slot, with its steps, the AI executions behind them, a verdict and a cost. A run never overwrites a field a person edited, and publishes nothing its verdict did not pass.
Customer
The visitors who have an account on a website, and the groups they are segmented into — by hand in a
MANUAL group, by a rule in a DYNAMIC one. A customer belongs to one website, and signs in to it on the site itself; what is managed here is who they are, which groups they are in, and whether they may sign in at all. The fields a website adds to its customers — customer_attributes, in sections of customer_attribute_groups — are defined here too, and put in order with :move.AI
How an account runs AI work: the connection that pays for it (its own Anthropic key, or the platform’s), the agent that says by which rules to run, the versioned instruction it renders, and the execution — one persistent run, with its model, its attempts, its tokens and its output.
ai_models and ai_system_agents are the platform’s own read-only catalogues to build on.AI Billing
What an account’s AI work cost: the balance and the limits it is spent against, the immutable ledger of every charge, and the usage record of every attempt — kept for a key of your own too, where nothing is charged.
Media
The image library: multipart upload, folders, and the read that serves a stored file transformed on the fly —
w, h, crop, q and fmt are the whole vocabulary, and it is the same URL a rendered site fetches.Analytics
What a website’s visitors did, as metrics rather than as events: requests, page views, unique visitors and who is on the site right now.
:query reads one metric over a period in the site’s own time zone, as a total and as a series; anything counted with a probabilistic sketch says so with approximate. Collection happens on the site’s own domain and is not part of this API.Dashboard
The widget grid a tenant arranges for one website — what is on it, where, and how each tile is configured — plus
dashboard_widget_types, the platform’s catalogue of tiles it can hold. The dashboard is a singleton that always exists: read it before anything was ever saved and it answers with the default layout, and :reset puts that layout back.View
A view is one presentation of a website — its locale, its URL prefix and its fallback. Content carries a per-view overlay, and settings can be overridden per view.
View Settings
Settings overridden for one view, addressed by their dotted path, plus
setting_descriptors — the registry of paths that may be overridden at all.Website Settings
Website-wide settings, addressed by their dotted path.
:batch_update writes many of them atomically.Theme
The CSS-variable map a site renders with, plus the branding and wiring around it: logo, favicon, main menu and footer block. An unknown variable survives a round trip.
Operation
The long-running operation of §17: poll until
done, then read exactly one of response / error. :cancel asks a running one to stop.Search
Re-indexing a website’s search corpus. It answers with an Operation; there is no query endpoint here — ranked search is served on the site’s own domain.
User
Sign-in and the password lifecycle.
:authenticate returns the bearer JWT every other call needs.User Profile
The signed-in user’s own profile — read it, patch it, or close the account with
:delete_account.Access
Who belongs to an account and what each member may do.
permissions is the tree of sections a right is granted on — READ or WRITE, and a grant covers everything under its section — roles the three every account has: administrator, editor, and one that holds only the sections its membership grants, accounts/{account}/roles the named sets of grants an account defines for itself, accounts/{account}/members the account’s members with their roles, and accounts/{account}/invitations the people asked to join by e-mail — who take the mailed link up with invitations:accept. A route a member’s role does not reach answers PERMISSION_DENIED.Security Schemes
bearerAuth
§19:
Authorization: Bearer <jwt>. No API keys, no tokens in query strings, no session cookies.http