The admin API of the Total.js CMS: manage a site from code, backup and restore

CMS · cms@8071e48 cmsapiadminbackuprestorepermissions

Everything the admin interface does goes through one endpoint: POST /admin/ with the body { "schema": "<name>", "data": { ... } } (the Total.js API routes, see API routes). The address comes from the line $api : /admin/ of the file config. Authenticate with the session cookie (POST /admin/ with schema: "login" and the login and password), with the header x-token or through OpenPlatform (install and first start).

The actions

Plugin	Calls (`schema`)	Permission
Account	`login`, `logout`, `admin_read`, `admin_save` (name, login, password), `account`	the session
Pages	`pages_list`, `pages_read`, `pages_save`, `pages_clone`, `pages_remove`, `pages_links`, `pages_html` (reads the HTML), `pages_save_html` (`id`, `html`, up to 5 MB), `pages_copy` (`from`, `to`)	`pages`
Layouts	`layouts_list`, `layouts_read`, `layouts_save`, `layouts_clone`, `layouts_remove`, `layouts_html`, `layouts_save_html`, `layouts_import`	`layouts`
Widgets	`widgets_list`, `widgets_read`, `widgets_save`, `widgets_remove`, `widgets_detail`	`widgets`
Navigation	`nav_list`, `nav_read`, `nav_save`, `nav_remove`, `nav_editor`	`navigation`
Redirects	`redirects_list`, `redirects_read`, `redirects_save` (`url`, `target`, `permanent`), `redirects_remove`	`redirects`
Variables	`variables_read`, `variables_save` (`vars`)	`variables`
Posts	`posts`, `posts_read`, `posts_create`, `posts_update`, `posts_remove`, `posts_clear`, `posts_categories`	`posts`
Files	`files_list`, `files_rename`, `files_clear`, `files_remove`, and the uploads below	`files`
Settings	`settings_read`, `settings_save`, `settings_test` (tries the SMTP settings), `chatgpt`	`settings`
Dashboard	`dashboard_online`, `dashboard_referers`, `dashboard_browsers`, `dashboard_pages`, `dashboard_stats`	none

The permission admin (and every user with the flag sa, including the Bot of the token) is allowed in all of them. A call without permission is answered with an error, and login is the only call that does not need a session.

Create a page and its content:

{ "schema": "pages_save", "data": { "name": "About", "layoutid": "<layout id>", "url": "/about/", "title": "About us" } }
{ "schema": "pages_save_html", "data": { "id": "<page id>", "html": "<h1>About us</h1>" } }

pages_save answers { "success": true }; read the id with pages_list. For a layout, layouts_save answers the id of the layout in value. When a field is missing from an update, the field is cleared (a title that you do not send is saved empty), so send the whole record.

Uploading files

POST /admin/upload/ takes a multipart upload (up to 10 MB) and POST /admin/upload/base64/ a JSON body with a data URI (png, jpeg or gif). Both answer a list of { id, name, type, ext, size, url } where url is /download/<id>.<ext>.

Backup, restore and clear

Three routes of controllers/api.js work on the whole site and need the permission admin:

Route	What it does
`GET /admin/backup/`	downloads the whole file storage (metadata, HTML of pages and layouts, files and posts) as one text file named after the site and the date
`POST /admin/restore/`	uploads such a file (up to 100 MB) and loads it.
`GET /admin/clear/`	deletes the content of the site. It drops the file storage and loads it again, so pages, layouts, widgets and the rest are removed

Make a backup before you try any of these, never open /admin/clear/ in a browser out of curiosity, and keep the token private: with it, a single GET empties the site.