REST from any language

Reads pass read_key. The OpenAPI document is openapi.json.

curl -G "https://api.cosmicjs.com/v3/buckets/$BUCKET_SLUG/objects"   --data-urlencode "read_key=$BUCKET_READ_KEY"   --data-urlencode 'query={"type":"posts"}'   --data-urlencode "limit=20"
const params = new URLSearchParams({
  read_key: process.env.BUCKET_READ_KEY,
  query: JSON.stringify({ type: 'posts' }),
  limit: '20',
});
const response = await fetch(
  `https://api.cosmicjs.com/v3/buckets/${process.env.BUCKET_SLUG}/objects?${params}`
);
const { objects } = await response.json();
# Python urllib: see the Python guide.
$query = http_build_query([
  'read_key' => getenv('BUCKET_READ_KEY'),
  'query' => json_encode(['type' => 'posts']),
  'limit' => 20,
]);
$json = file_get_contents(
  'https://api.cosmicjs.com/v3/buckets/'.getenv('BUCKET_SLUG')."/objects?$query"
);
$objects = json_decode($json, true)['objects'];

Create an object:

curl -X POST "https://api.cosmicjs.com/v3/buckets/$BUCKET_SLUG/objects"   -H "Authorization: Bearer $BUCKET_WRITE_KEY"   -H "Content-Type: application/json"   -d '{"title":"Hello","type":"posts","metadata":{"content":"Body"}}'

Language pages: Python, Django, Laravel, Rails, Go.

FAQ

What is the base URL?

https://api.cosmicjs.com/v3

How is a filter sent?

The query parameter is URL-encoded JSON, such as {"type":"posts"}.

How is a write authorized?

Authorization: Bearer WRITE_KEY on POST, PATCH, and DELETE.

How much does Cosmic cost?

Project plans are Free ($0), Builder ($99/mo), Team ($299/mo), Business ($499/mo), Enterprise (custom pricing). Yearly billing saves 10%. Workspace plans are Small Workspace ($999/mo) and Large Workspace ($2,999/mo), and they start with a 30-day free trial. Allowances, add-on rates, and the rest of the pricing FAQ are plain text at https://www.cosmicjs.com/pricing.md.

Are API keys required, and is content private?

Each Bucket has a read key and a write key in Bucket Settings > API Access. GET requests use the read key. POST, PATCH, and DELETE use the write key as Authorization: Bearer. Do not put the write key in a browser bundle, a mobile app, or a NEXT_PUBLIC_ variable. SAML single sign-on is on Large Workspace and Enterprise. The audit log is append-only. Text versions: https://www.cosmicjs.com/security.md and https://www.cosmicjs.com/docs/dashboard/audit-log.md.

Can an agent create a Cosmic project without an existing account?

Yes. POST https://dapi.cosmicjs.com/v3/agents/sign-up provisions a free-tier project and bucket tied to a human email, with no existing Cosmic account. The human claims it with the emailed one-time code. The playbook is https://www.cosmicjs.com/docs/ai-onboarding.md.