---
name: macro-api
description: >-
  Call macrocontent HTTP APIs — authentication, X-Macro-Token, OpenAPI,
  management/content/store/publisher surfaces. Use when automating websites,
  publishing, tokens, or Store/publisher workflows.
---

# macrocontent API

## Docs

- API hub: https://docs.macrocontent.dev/api/
- Auth: https://docs.macrocontent.dev/api/auth/
- Swagger UI (humans): https://api.macrocontent.dev/docs/
- **OpenAPI catalog (agents):** https://api.macrocontent.dev/docs.json
- **OpenAPI mirror:** https://docs.macrocontent.dev/openapi/index.json
- Recipes: https://docs.macrocontent.dev/api/recipes/

## OpenAPI specs (fetch these — full paths)

Do **not** scrape Swagger UI HTML. Load JSON:

| Surface | URL |
|---------|-----|
| Management | https://api.macrocontent.dev/docs/specs/management.json |
| Content | https://api.macrocontent.dev/docs/specs/content.json |
| Store | https://api.macrocontent.dev/docs/specs/store.json |
| Publisher | https://api.macrocontent.dev/docs/specs/publisher.json |

Mirrors on the docs host (same JSON):

- https://docs.macrocontent.dev/openapi/management.json
- https://docs.macrocontent.dev/openapi/content.json
- https://docs.macrocontent.dev/openapi/store.json
- https://docs.macrocontent.dev/openapi/publisher.json

## Auth summary

- Dashboard session: Bearer JWT from login flows (dashboard/account apps).
- Editor / SDK site calls: frontend key headers as documented in credentials + keys guides.
- Management automation: tokens with header **`X-Macro-Token`** — details in the API auth handbook.

## Rules

1. Do **not** invent paths — load the matching OpenAPI spec first.
2. Prefer documented recipes for publish / rotate token / validate listing / install component.
3. Never embed management tokens in browser `macro.config.js`.