Self-hosted API

The bundled Express /api serves the dashboard and accepts personal API tokens for scripts. It changes with OrbitPage releases; it has no separate stable API version.

Keep scripts aligned with the installed release. The managed-service API and n8n node use different credentials and endpoints.

Authentication

Create a token under Team → Personal API tokens. Choose its access and expiry, enter the current password, and copy the secret once. See Account and team.

curl https://page.example.com/api/links/export \
  --header "Authorization: Bearer $ORBITPAGE_TOKEN"

Use HTTPS and store the token privately. Do not put credentials in URLs, logs, screenshots, or issue reports.

Tokens are stored as hashes. Their access cannot exceed the user's current role, and they cannot manage users or obtain dashboard sessions. Role changes apply immediately; deleting an account deletes its tokens.

Routes and implementation

For example, GET /api/account/audit-log requires users:manage and supports q, actor, action, from, to, and before filters. It returns successful change metadata, not page contents.

GET /api/shop/info serves Shop settings → INFO. It requires an administrator dashboard session (users:manage); personal API tokens cannot access it. It returns a minimal service summary and instance health results with private, non-cacheable responses. See INFO and health-check FAQ.

When changing a route, update its client and server together, retain validation and permissions, and test the changed behavior. Keep dashboard and API on the same origin unless additional trusted origins are configured.

Network and recovery settings: Configuration, Security.

Managed automation

The hosted service has its own versioned API:

• Managed API guide
• Managed OpenAPI
• n8n community node