Delivery API

Read published pages, entries, globals, routes and redirects from Atlas, and report your website's build.

The Delivery API is how your website reads published content. Call it from server code only.

Base URL and authentication

https://<delivery host>/v1/delivery/environments/{environmentId}
Authorization: PublishedConsumer <delivery token>

Each token belongs to one environment. Development and Production have separate tokens.
Tokens are 43 random characters, shown once, valid for 1 to 365 days, and can be revoked at any time in Studio. Atlas stores only a fingerprint.
A Production token reads only the live release of that environment.

Caching

Published responses carry:

Cache-Control: public, max-age=0, s-maxage=60, stale-while-revalidate=300
ETag: W/"…"
X-Atlas-Content-Version: …
Vary: Authorization, Accept-Encoding

Send If-None-Match with the last ETag; Atlas answers 304 Not Modified when nothing changed. Combine this with webhooks to refresh on publish. Preview and deployment responses are private, no-store.

Endpoints

`GET /site`

The environment, its live release (Production), the content version and the active contract’s digest and version.

`GET /routes`

Every published route, for your sitemap and static generation: route, pageType, entryId, title, lastModified, noindex, locales. Up to 5,000 routes.

`GET /pages?route=/about&locale=en`

One published page.

Field	Contents
`page`	`id`, `route`, `title`, `pageType`, `publishedAt`, `entryId`
`document`	`pageType`, `pageFields`, and `regions`: each region is an ordered list of sections
`document.regions[key][n]`	`id`, `component { id, version }`, `props`, `hidden`
`entry`	The page’s bound entry, if its page type has one
`seo`	`title`, `description`, `noindex`, `structuredDataType`, `canonicalPath`, `faq`
`head`	Ready-to-print `title`, `meta[]`, `links[]` and `jsonLd[]`, or `null` with `headProblem`
`assets`	Every image the page uses, by asset id: `url`, `renditions`, `alt`, `focalPoint`
`locale`, `direction`, `translation`, `alternates`	Language of the response, `ltr`/`rtl`, whether a translation was missing, and other locales
`etag`	The revision’s ETag

404 when nothing is published at that route. Skip sections where hidden is true. See Search and AI answers for using head.

`GET /preview/pages?token=…&locale=en`

A draft page for a preview link. Development only (404 on Production). Never cache it. 403 PREVIEW_INVALID for a bad token, 410 PREVIEW_EXPIRED after 15 minutes.

`GET /entries?collection=projects`

Entries of a collection.

Parameter	Example	Notes
`collection`	`projects`	Required
`locale`	`ar`
`filter`	`category:water,featured:true`	`field:value` pairs, comma-separated
`sort`	`-publishedAt`, `title`, `slug`, `featured`, `field.year`	Prefix `-` for descending
`fields`	`title,slug,image`	Return only these fields
`limit`	`20`	Up to 100. Always set it; without it the response can be large
`page`	`2`

Returns entries, assets and meta.pagination.

`GET /feed?collection=news&limit=20`

Latest entries of an editorial collection, for RSS and news listings. 404 FEED_NOT_EDITORIAL for other collections.

`GET /globals?locale=en`

Shared content such as site-header and site-footer: { globals: { key: { data, revision, publishedAt } }, assets }.

`GET /redirects`

{ redirects: [{ from, to, status }] }. Apply them in your middleware or next.config redirects.

`GET /media/{assetId}?rendition=…`

Redirects (302) to a signed image URL valid for 15 minutes. No token needed, so you can use it in <img src>.

`GET /sitemap.xml`, `GET /robots.txt`, `GET /llms.txt`

Files for your site’s root, built from the live release (Production) or locked down (Development: empty sitemap, Disallow: /, X-Robots-Tag: noindex, nofollow). Proxy them from your own domain so the token stays on your server; see Search and AI answers. 409 SITE_ADDRESS_MISSING until the environment has a website address.

Report a deployment

POST /deployments, called by your website when it starts:

{
  "bundleDigest": "<sha256 hex of the contract bundle this build renders>",
  "bundleVersion": "1.4.0",
  "commit": "a1b2c3d",
  "components": [{ "id": "acme.home.hero", "version": "1.0.0" }],
  "runtime": "node",
  "siteOrigin": "https://dev.example.com"
}

The response’s state is in-sync, missing-components, different-contract, unknown-contract or no-contract, with the active digest and any missing components. runtime is node or cloudflare-workers. Up to 500 components.

Errors

Errors are JSON with a stable code. See Limits and errors.

Base URL and authentication

Caching

Endpoints

GET /site

GET /routes

GET /pages?route=/about&locale=en

GET /preview/pages?token=…&locale=en

GET /entries?collection=projects

GET /feed?collection=news&limit=20

GET /globals?locale=en

GET /redirects

GET /media/{assetId}?rendition=…

GET /sitemap.xml, GET /robots.txt, GET /llms.txt