Crevio Pages API

openapi: 3.2.0
info:
  title: Crevio API V1 Pages API
  version: 1.0.0
  description: 'API for the Crevio creator platform — a multi-tenant SaaS for digital product sales.

    Uses snake_case keys following Stripe conventions. All resource IDs are string IDs (e.g., "prod_abc123").


    Authentication is a bearer token: `Authorization: Bearer $CREVIO_API_KEY`.

    List endpoints are cursor-paginated with `limit` and `starting_after`.

    Writes accept an `Idempotency-Key` header and are safe to retry.


    Every response carries IETF RateLimit headers (`RateLimit`, `RateLimit-Policy`) so a client can

    self-throttle, and `Retry-After` on a 429. The quota is 600 requests per minute per credential.


    The API is versioned in the URL path (`/v1`). Nothing is removed without in-band warning: a

    deprecated operation is marked `"deprecated": true` here and serves `Deprecation` (RFC 9745),

    `Sunset` (RFC 8594) and `Link; rel="deprecation"` headers for at least six months before it

    stops answering. See https://crevio.co/docs/developer/guides/versioning.'
  contact:
    email: support@crevio.co
    name: Crevio Support
    url: https://crevio.co/docs
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  termsOfService: https://crevio.co/legal/terms-of-service
servers:
- url: https://api.crevio.co/v1
  description: Production
security:
- ApiKey: []
tags:
- name: Pages
  description: Self-contained HTML pages hosted at a stable link
paths:
  /pages:
    get:
      summary: List pages
      description: 'Lists the account''s hosted pages: slug, URL, access, title, size, versions kept and timestamps.'
      operationId: listPages
      x-crevio-sdk-method: list
      tags:
      - Pages
      security:
      - ApiKey: []
      responses:
        '200':
          description: Pages
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponse_PublishedPage'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: allow
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.pages.list();\n\n  console.log(result);\n}\n\nrun();"
    post:
      summary: Publish a page
      description: 'Publishes one self-contained HTML document as a hosted web page with a stable link — no site, no build, no deploy wait. For reports, briefs, plans, interactive charts and sortable tables: anything the user should open and keep. The HTML must inline its CSS and JS or load them from absolute CDN URLs, and runs sandboxed with no cookies or localStorage. Publishing the same slug again replaces the page at the same URL and keeps the previous version. Pages are capped at 2 MB. Not for a storefront or anything that needs a database or server logic — that is a site.'
      operationId: publishPage
      x-crevio-sdk-method: publish
      tags:
      - Pages
      security:
      - ApiKey: []
      parameters:
      - name: Idempotency-Key
        in: header
        required: false
        description: 'Makes this write safe to retry: a repeat with the same key replays the first response instead of creating a second resource. Scoped to the account, remembered for 24 hours; reusing a key with a different payload is an error.'
        schema:
          type: string
          maxLength: 255
        example: 1f7a4c2e-3b19-4a6d-9f0c-2ac81b5d7e33
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                html:
                  type: string
                  description: The page's HTML. Give exactly one of `html` or `file_path`.
                file_path:
                  type: string
                  description: Absolute path of the HTML file on the account's Crevio computer (e.g. `/workspace/reports/q2.html`). Give exactly one of `html` or `file_path`.
                slug:
                  type: string
                  pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$
                  maxLength: 60
                  description: 'URL slug: lowercase letters, digits and hyphens. Becomes the page path, so pick something readable. Defaults to a slug of the page''s <title>.'
                access:
                  type: string
                  enum:
                  - public
                  - members
                  - specific_members
                  default: members
                  description: 'Who can open the link. `members`: signed-in members of this account. `specific_members`: only the people in `members` and `groups` (account admins keep access). `public`: anyone on the internet — only when the user explicitly asked for a shareable public link.'
                members:
                  type: array
                  items:
                    type: string
                  maxItems: 50
                  description: 'For `specific_members`: emails of team members allowed to open the page. Someone who is not on the team fails the call; invite them first.'
                groups:
                  type: array
                  items:
                    type: string
                  description: 'For `specific_members`: names of the account''s groups whose members may open the page.'
                named_only:
                  type: boolean
                  default: false
                  description: 'For `specific_members`: keep account admins out too, so only the named people and groups and the page''s access manager can open it.'
                live_tools:
                  type: array
                  items:
                    type: string
                  maxItems: 20
                  description: 'Read-only tool roles the page may call at view time (e.g. `crevioApi.listOrders`), for a dashboard that stays current: in the page, `crevio.watch(role, args, ({data, storedAt, cached, error}) => render(...), {refreshEvery: 60000})` shows the last result instantly and refetches it; `await crevio.call(role, args)` fetches once. Calls run as whoever views the page. Data stays off until an account admin approves it, which happens on its own when an admin asked for the page in the chat. A live page cannot be public. Omit for a static page; republishing without it makes the page static again.'
                overwrite:
                  type: boolean
                  default: true
                  description: Replace an existing page of the same slug. `false` fails instead.
                screenshot:
                  type: boolean
                  default: true
                  description: Render a preview image of the page. Gated links do not unfurl, so pair the preview with the link on other surfaces.
      responses:
        '200':
          description: Page replaced
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/PublishedPage'
                - type: object
                  required:
                  - replaced
                  - note
                  properties:
                    replaced:
                      type: boolean
                      description: Whether a page with this slug was replaced.
                    note:
                      type: string
                      description: How to share the link.
                    screenshot_error:
                      type: string
                      description: Why no preview was rendered. The page is live either way.
        '201':
          description: Page published
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/PublishedPage'
                - type: object
                  required:
                  - replaced
                  - note
                  properties:
                    replaced:
                      type: boolean
                      description: Whether a page with this slug was replaced.
                    note:
                      type: string
                      description: How to share the link.
                    screenshot_error:
                      type: string
                      description: Why no preview was rendered. The page is live either way.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.pages.publish({});\n\n  console.log(result);\n}\n\nrun();"
  /pages/{slug}:
    get:
      summary: Retrieve a page
      description: Retrieves one hosted page by its slug.
      operationId: getPage
      x-crevio-sdk-method: get
      tags:
      - Pages
      security:
      - ApiKey: []
      parameters:
      - name: slug
        in: path
        required: true
        description: The page's URL slug.
        schema:
          type: string
      responses:
        '200':
          description: The page
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublishedPage'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: allow
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.pages.get({\n    slug: \"<value>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
    delete:
      summary: Delete a page
      description: Deletes a hosted page. Its URL stops serving immediately; publish under the same slug to bring it back.
      operationId: deletePage
      x-crevio-sdk-method: delete
      tags:
      - Pages
      security:
      - ApiKey: []
      parameters:
      - name: slug
        in: path
        required: true
        description: The page's URL slug.
        schema:
          type: string
      responses:
        '200':
          description: Page deleted
          content:
            application/json:
              schema:
                type: object
                required:
                - slug
                - object
                - deleted
                properties:
                  slug:
                    type: string
                    description: The deleted page's slug.
                  object:
                    type: string
                    enum:
                    - page
                  deleted:
                    type: boolean
                    enum:
                    - true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.pages.delete({\n    slug: \"<value>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
  /pages/{slug}/source:
    get:
      summary: Retrieve a page's HTML
      description: Returns a page's stored HTML, so a page whose source file is gone can be edited and published again under the same slug. Pass `version` for an earlier version instead (1 is the one replaced most recently; the page's `versions` says how many are kept), e.g. to restore it.
      operationId: getPageSource
      x-crevio-sdk-method: getSource
      tags:
      - Pages
      security:
      - ApiKey: []
      parameters:
      - name: slug
        in: path
        required: true
        description: The page's URL slug.
        schema:
          type: string
      - name: version
        in: query
        required: false
        description: 'An earlier version: 1 is the most recently replaced.'
        schema:
          type: integer
          minimum: 1
      responses:
        '200':
          description: The page's HTML
          content:
            application/json:
              schema:
                type: object
                required:
                - object
                - slug
                - title
                - html
                properties:
                  object:
                    type: string
                    enum:
                    - page_source
                  slug:
                    type: string
                  title:
                    type:
                    - string
                    - 'null'
                  html:
                    type: string
                  version:
                    type: integer
                    description: The earlier version returned, when one was asked for.
                  replaced_at:
                    type: string
                    format: date-time
                    description: When that version was replaced.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: allow
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.pages.getSource({\n    slug: \"<value>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
components:
  responses:
    TooManyRequests:
      description: 'Rate limit exceeded — 600 requests per minute per owner on the free tier: every API key and OAuth token one person holds on an account shares one budget, and the account''s team keys share another. Retry after the number of seconds in `Retry-After`.'
      headers:
        Retry-After:
          $ref: '#/components/headers/RetryAfter'
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: rate_limit_exceeded
              message: Too many requests. Please retry later.
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: forbidden
              message: You do not have permission to perform this action
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: api_error
              code: internal_error
              message: An unexpected error occurred
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: bad_request
              message: The request was malformed or contained invalid parameters
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: resource_missing
              message: The requested resource was not found
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    Unauthorized:
      description: Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: authentication_required
              message: You did not provide an API key.
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    UnprocessableEntity:
      description: Validation error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: validation_error
              code: validation_failed
              message: Email is required
              errors:
                email:
                - can't be blank
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
  headers:
    RetryAfter:
      description: Seconds to wait before retrying.
      schema:
        type: integer
        examples:
        - 11
    Sunset:
      description: Present only on a deprecated operation. HTTP-date (RFC 8594) after which the operation stops responding. Always at least six months after `Deprecation`.
      schema:
        type: string
        examples:
        - Thu, 01 Oct 2026 00:00:00 GMT
    RateLimit:
      description: 'Remaining quota for the current window, as an IETF structured field: `"default";r=<remaining>;t=<seconds until reset>`.'
      schema:
        type: string
        examples:
        - '"default";r=596;t=11'
    RateLimitPolicy:
      description: 'The quota this credential is subject to: `"default";q=<requests>;w=<window seconds>`.'
      schema:
        type: string
        examples:
        - '"default";q=600;w=60'
    RequestId:
      description: Unique id for this request. Quote it when reporting a problem.
      schema:
        type: string
        examples:
        - 8fe045fe-cb8a-4407-a44d-5df60385e522
    DeprecationLink:
      description: Present only on a deprecated operation. `<url>; rel="deprecation"` pointing at the migration notes.
      schema:
        type: string
        examples:
        - <https://crevio.co/docs/developer/guides/versioning>; rel="deprecation"
    Deprecation:
      description: Present only on a deprecated operation. Structured-field date (RFC 9745) — `@` followed by the Unix timestamp at which the operation became deprecated.
      schema:
        type: string
        examples:
        - '@1775001600'
  schemas:
    PublishedPage:
      type: object
      properties:
        object:
          type: string
        slug:
          type: string
        title:
          type:
          - string
          - 'null'
        access:
          type: string
          enum:
          - public
          - members
          - specific_members
        url:
          type: string
        access_note:
          type: string
        members:
          type: array
          items:
            type: string
        named_only:
          type: boolean
        access_manager:
          type:
          - string
          - 'null'
        live_tools:
          type: array
          items:
            type: string
        live_status:
          type:
          - string
          - 'null'
        screenshot_url:
          type:
          - string
          - 'null'
        size_bytes:
          type: integer
        versions:
          type: integer
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
      - object
      - slug
      - title
      - access
      - url
      - access_note
      - members
      - named_only
      - access_manager
      - live_tools
      - live_status
      - screenshot_url
      - size_bytes
      - versions
      - created_at
      - updated_at
    ListResponse_PublishedPage:
      type: object
      properties:
        object:
          type: string
          enum:
          - list
        data:
          type: array
          items:
            $ref: '#/components/schemas/PublishedPage'
        has_more:
          type: boolean
        url:
          type: string
      required:
      - object
      - data
      - has_more
      - url
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
              - api_error
              - invalid_request_error
              - validation_error
            code:
              type: string
            message:
              type: string
            param:
              type: string
            errors:
              type: object
            doc_url:
              type: string
          required:
          - type
          - message
      required:
      - error
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: Authorization
      description: 'API key in the format: Bearer {api_token}'
externalDocs:
  description: Crevio developer documentation
  url: https://crevio.co/docs/developer
x-mint:
  mcp:
    enabled: true
x-api-lifecycle:
  current_major_version: v1
  versioning_scheme: URL path
  deprecation_policy_url: https://crevio.co/docs/developer/guides/versioning
  minimum_notice_days: 183
  deprecation_headers:
  - Deprecation
  - Sunset
  - Link