Posit Content API
The Content API from Posit — 14 operation(s) for content.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
email: support@posit.co
name: Posit Connect Support
url: https://support.posit.co/hc/en-us
description: "## Overview\n\nThe Posit Connect Server API can be used to perform certain\nuser actions remotely. You will need to install a tool or library\nthat can make HTTP requests. We recommend using one of our SDKs, which\nare designed to make it easier to interact with the API.\n\n- Python: [posit-sdk](https://github.com/posit-dev/posit-sdk-py/)\n- R: [connectapi](https://posit-dev.github.io/connectapi/)\n\nThe SDKs are designed to work with the following values set in environment\nvariables, though you may provide them directly to the SDK if you prefer:\n\n- `CONNECT_SERVER` - The URL of the Posit Connect server.\n- `CONNECT_API_KEY` - Your API key.\n\nPlease note that all API paths are relative to the base API URL\n(e.g., `https://connect.example.com/__api__`).\nUnless otherwise noted, all endpoints which accept a request body\nwill require the body to be in JSON format.\nSimilarly, all response bodies will be returned in JSON format.\n\n### Specifications {#download}\n\nThe Posit Connect Server API OpenAPI specification is available for\ndownload as either JSON or YAML. Both formats contain the same\ninformation, also presented on this page.\n\n* <a href=\"openapi.json\" title=\"OpenAPI (JSON)\" target=\"_blank\">OpenAPI (JSON)</a>\n* <a href=\"openapi.yaml\" title=\"OpenAPI (YAML)\" target=\"_blank\">OpenAPI (YAML)</a>\n\n### Versioning of the API {#versioning-policy}\n\nThe Posit Connect Server API uses a simple, single number versioning scheme as noted\nas the first part of each endpoint path. This version number will only be incremented\nin the event that non-backward compatible changes are made to an existing endpoint.\nNote that this occurs on a per-endpoint basis; see the section on\n[deprecation](#deprecation) below for more information.\n\nChanges that are considered backward compatible are:\n\n* New fields in responses.\n* New non-required fields in requests.\n* New endpoint behavior which does not violate the current functional intent of the\n endpoint.\n\nChanges that are considered non-backward compatible are:\n\n* Removal or rename of request or response fields.\n* A change of the type or format of one or more request or response fields.\n* Addition of new required request fields.\n* A substantial deviation from the current functional intent of the endpoint.\n\nThe points relating to functional intent are assumed to be extremely rare as more\noften such situations will result in a completely new endpoint, which makes the\nchange a backward compatible addition.\n\n#### Experimentation\n\nPosit Connect labels experimental endpoints in the API by including `/experimental`\nin the endpoint path immediately after the version indicator. If an endpoint is noted\nas experimental, it should not be relied upon for any production work. These are\nendpoints that Posit Connect is making available to our customers to solicit\nfeedback; they are subject to change without notice. Such changes include anything\nfrom altered request/response shapes, to complete abandonment of the endpoint.\n\nThis public review of an experimental endpoint will last as long as necessary to either\nprove its viability or to determine that it's not really needed. The time for this\nwill vary based on the intricacies of each endpoint. When the endpoint is finalized,\nthe next release of Posit Connect will mark the experimental path as deprecated while\nadding the endpoint without the `/experimental` prefix. The path with the experimental\nprefix will be removed six months later. The documentation for the endpoint will also\nnote, during that time, the original, experimental, path.\n\nAll experimental endpoints are clearly marked as such in this documentation.\n\n#### Deprecation and removal of old versions {#deprecation}\n\nIt is possible that Posit Connect may decide to deprecate an endpoint. This will\nhappen if either the endpoint serves no useful purpose because its functionality is\nnow handled by a different endpoint or because there is a newer version of the endpoint\nthat should be used.\n\nIf a deprecated endpoint is called, the response to it will include an extra HTTP\nheader called, `X-Deprecated-Endpoint` and will have as a value the path of the\nendpoint that should be used instead. If the functionality has no direct replacement,\nthe value will be set to `n/a`.\n\nDeprecated versions of an endpoint will be supported for 1 year from the release date\nof Posit Connect in which the endpoint was marked as deprecated. At that time, the\nendpoint is subject to removal at the discretion of Posit Connect. The life cycle\nof an endpoint will follow these steps.\n\n1. The `/v1/endpoint` is public and in use by Posit Connect customers.\n1. Posit Connect makes `/v2/experimental/endpoint` available for testing and feedback.\n Customers should still use `/v1/endpoint` for production work.\n1. Posit Connect moves version 2 of the endpoint out of experimentation so, all within\n the same release:\n 1. `/v1/endpoint` is marked as deprecated.\n 1. `/v2/experimental/endpoint` is marked as deprecated.\n 1. `/v2/endpoint` is made public.\n1. Six months later, `/v2/experimental/endpoint` is removed from the product.\n1. Twelve months later, `/v1/endpoint` is removed from the product.\n\nNote that it is possible that Posit Connect may produce a new version of an existing\nendpoint without making an experimental version of it first. The same life cycle,\nwithout those parts, will still be followed.\n\n### Authentication {#authentication}\n\nAPI endpoints require you to identify yourself as a valid Posit Connect\nuser. You do this by specifying an API key when you make a call to the\nserver. The [API Keys](../user/api-keys/) chapter of the Posit Connect\nUser Guide explains how to create an API key.\n\n#### API Keys {#api-keys}\n\nAPI keys are managed by each user in the Posit Connect\ndashboard. If you ever lose an API key or otherwise feel it has\nbeen compromised, use the dashboard to revoke the key and create\nanother one.\n\n**WARNING**: Keep your API key safe. If your Posit Connect server's URL does not begin\nwith `https`, your API key could be intercepted and used by a malicious actor.\n\nOnce you have an API key, you can authenticate by passing the key with a prefix\nof `\"Key \"` (the space is important) in the Authorization header.\n\nBelow are examples of invoking the \"Get R Information\" endpoint.\n\n##### cURL\n\n```bash\ncurl -H \"Authorization: Key XXXXXXXXXXX\" \\\n https://positconnect.example.com/__api__/v1/server_settings/r\n```\n\n##### R\n\n```r\nlibrary(httr)\napiKey <- \"XXXXXXXXXXX\"\nresult <- GET(\"https://positconnect.example.com/__api__/v1/server_settings/r\",\n add_headers(Authorization = paste(\"Key\", apiKey)))\n```\n\n##### Python\n\n```python\nimport requests\nr = requests.get(\n 'https://positconnect.example.com/__api__/v1/server_settings/r',\n headers = { 'Authorization': 'Key XXXXXXXXXXX' }\n)\n```\n\n### API CORS considerations {#api-cors-considerations}\n\nFor information about using Connect's API from web applications in different domains,\nsee the [Cross-Origin Resource Sharing (CORS)](../admin/security/index.md#cors) section in\nthe security documentation.\n\n### Request correlation {#request-correlation}\n\nPosit Connect assigns a correlation ID to every API request via the\n`X-Correlation-ID` HTTP header. Connect includes this identifier in the response\nheaders and in server-side log entries, making it possible to trace a specific\nrequest through the system.\n\nIf you include an `X-Correlation-ID` header in your request, Connect preserves that\nvalue. If you do not include the header, Connect generates a Universally Unique\nIdentifier (UUID) automatically. Either way, the same value is returned in the\nresponse header.\n\nThis header is useful for:\n\n- **Debugging failed requests**: provide the correlation ID to your administrator so\n they can locate the corresponding server-side log entries.\n- **Correlating client-side and server-side activity**: set a known correlation ID in\n your client and match it against server logs or OpenTelemetry traces.\n\n**Example**\n\n```bash\n# Let Connect generate a correlation ID\ncurl -H \"Authorization: Key XXXXXXXXXXX\" -i \\\n https://positconnect.example.com/__api__/v1/user\n# Response includes: X-Correlation-ID: <generated-uuid>\n\n# Provide your own correlation ID\ncurl -H \"Authorization: Key XXXXXXXXXXX\" \\\n -H \"X-Correlation-ID: my-request-123\" -i \\\n https://positconnect.example.com/__api__/v1/user\n# Response includes: X-Correlation-ID: my-request-123\n```\n\n### API error codes {#api-error-codes}\n\n{{< include src/api_codes.fragment.html >}}\n"
license:
name: Commercial. Copyright 2015-2026 Posit Software, PBC. All Rights Reserved.
url: https://posit.co/about/eula/
termsOfService: https://posit.co/about/eula/
title: Posit Connect API Reference API Keys Content API
version: 1.0.1
servers:
- url: /__api__
security:
- apiKey: []
tags:
- name: Content
paths:
/v1/content:
get:
description: 'List all content items visible to the requesting user.
Authenticated access from a user is required. If an "administrator"
role is used, then all content items will be returned regardless of
the visibility to the requesting user.
Information about the target environment is populated for users with
"publisher" and "administrator" role; it is suppressed for viewers.'
operationId: getContents
parameters:
- description: 'The content name specified when the content was created.
Content names are unique within the owning user''s account, so a
request that specifies a non-empty name and owner_guid will return
at most one content item.'
in: query
name: name
schema:
type: string
- description: The unique identifier of the user who owns the content.
in: query
name: owner_guid
schema:
format: uuid
type: string
- description: 'Comma-separated set of values indicating additional details to include in the response.
* `tags`: Populates a `tags` field for each returned content item
containing the tags associated with this content item.
* `owner`: Populates an `owner` field for each returned content
item with basic details about the content owner.
* `vanity_url`: Populates the `vanity_url` field for each returned
content item if the content has an associated custom vanity URL.
* `bookmarked`: Populates a `bookmarked` field for each returned
content item indicating whether the requesting user has bookmarked
the content.
* `schedule`: Populates a `schedules` field for each returned
content item with the list of schedules associated with the
content, including variant details and last run information.
'
in: query
name: include
schema:
enum:
- tags
- owner
- vanity_url
- bookmarked
- schedule
type: string
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/Content'
type: array
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: You do not have permission to perform this operation.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: List content items
tags:
- Content
post:
description: Create a new content item.
operationId: createContent
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateContentInput'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Content'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: You do not have permission to perform this operation.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Create content item
tags:
- Content
/v1/content/{guid}:
delete:
description: Delete a specific content item. On-disk data and database records are removed.
operationId: deleteContent
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
responses:
'204':
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Delete content
tags:
- Content
get:
description: 'Get detailed information about a specific content item.
Unauthenticated clients are rejected regardless of the content access
type.
Authorized, non-administrator clients without viewership rights to
this content are rejected.
Authorized, administrator clients without viewership rights are
permitted to obtain information about this content. The computed
`app_role` for these users will be `none`, representing that these
users cannot view the content itself.
Authorized clients with viewership (or collaborator) rights are
permitted to obtain information about this content. The computed
`app_role` for these users will reflect the level of access.
Information about the target environment is populated for users with
"publisher" and "administrator" role; it is suppressed for viewers.'
operationId: getContent
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
- description: 'Comma-separated set of values indicating additional details to include in the response.
* `tags`: Populates a `tags` field for each returned content item
containing the tags associated with this content item.
* `owner`: Populates an `owner` field for each returned content
item with basic details about the content owner.
* `vanity_url`: Populates the `vanity_url` field for each returned
content item if the content has an associated custom vanity URL.
* `bookmarked`: Populates a `bookmarked` field for each returned
content item indicating whether the requesting user has bookmarked
the content.
* `schedule`: Populates a `schedules` field for each returned
content item with the list of schedules associated with the
content, including variant details and last run information.
'
in: query
name: include
schema:
enum:
- tags
- owner
- vanity_url
- bookmarked
- schedule
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Content'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Get content details
tags:
- Content
patch:
description: 'Update fields for a specific content item.
Authenticated access from a user having either "publisher" or
"administrator" role is allowed. All other clients are rejected.
Authorized clients with collaborator or administrator rights are
permitted to modify content item fields.
Administrators can reassign content ownership by updating
the `owner_guid` field. The new owner must have publisher or
administrator rights.'
operationId: updateContent
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateContentInput'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Content'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: You do not have permission to perform this operation.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Update content
tags:
- Content
/v1/content/{guid}/access-test:
post:
description: 'Trigger a Public Access Content Verification test for this content item.
Checks if a content item is available and reachable on the public
internet. If not, the result includes a message to help with
troubleshooting. The verification process is identical to the test
Connect performs automatically for all Public Access Content, but the
API can provide more details about verification failures or
immediately retest an item instead of waiting for the automatic
verification to run.
See the [Admin Guide](../admin/public-access)
and [User Guide](../user/content-settings/index.md#public-access-content-verification)
for more information about Public Access Content Verification.
To use this API, you must have a license with the Public Access
entitlement, the content item must be interactive (e.g. Shiny
applications, FastAPI APIs), and the content item must be configured
with the "Anyone - no login required"/`all` access type.'
operationId: testPublicAccess
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/AccessTestResult'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: You do not have permission to perform this operation.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Triggers a Public Access Content Verification test
tags:
- Content
/v1/content/{guid}/build:
post:
description: 'Build (restore) a deployment bundle.
Build requests spawn an asynchronous task to make your previously
uploaded data ready for rendering or running. Content will have its
environment reconstructed, e.g. by using the packrat R package to
install R package dependencies, but documents will not be re-rendered.
Building is intended to facilitate server changes or migrations that
may require re-installing R packages or other dependencies.
By default, the built bundle becomes the active bundle for the content.
You can prevent this by setting `activate: false` in the request body.
This allows you to build a bundle without making it the active version.
The response from this endpoint includes a task identifier. Poll the
[GET /v1/tasks/{id}](#getTask) endpoint to track the progress of this task.'
operationId: buildContentBundle
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ContentBuildInstructions'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ContentBuildTask'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Build deployment bundle
tags:
- Content
/v1/content/{guid}/deploy:
post:
description: 'Deploy (activate) a deployment bundle.
Deployment requests spawn an asynchronous task to make your previously
uploaded data available for serving. The workflow applied to the
bundled files varies depending on the type of content.
Executable content has its environment reconstructed. This includes
using the packrat R package to install R package dependencies.
Documents (R Markdown reports, Jupyter Notebooks, static Quarto content)
are rendered and the result made available.
Interactive content (applications and APIs) are available to be
launched on the next client visit.
The deployment workflow for static content (HTML, plots) is
lighter-weight than for executable content. File time-stamps are
updated to ensure that browsers do not cache previous results and
instead see the newly promoted files.
By default, the deployed bundle becomes the active bundle for the content.
You can prevent this by setting `activate: false` in the request body.
This allows you to deploy a bundle without making it the active version.
The response from this endpoint includes a task identifier. Poll the
[GET /v1/tasks/{id}](#getTask) endpoint to track the progress of this task.'
operationId: deployContentBundle
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ContentDeploymentInstructions'
required: true
responses:
'202':
content:
application/json:
schema:
$ref: '#/components/schemas/ContentDeploymentTask'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Deploy deployment bundle
tags:
- Content
/v1/content/{guid}/environment:
get:
description: Get the names of the environment variables defined for this content.
operationId: getContentEnvironment
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/EnvironmentVariableNames'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Get environment variables
tags:
- Content
patch:
description: Add, change, or delete environment variables for this content.
operationId: updateContentEnvironment
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EnvironmentVariables'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/EnvironmentVariableNames'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation requires authentication.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested object does not exist.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: A server error occurred.
summary: Update environment variables
tags:
- Content
put:
description: Set the environment for this content item. Any existing environment variables will be removed.
operationId: setContentEnvironment
parameters:
- in: path
name: guid
required: true
schema:
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EnvironmentVariables'
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/EnvironmentVariableNames'
description: Successful response.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: The requested operation is invalid.
'401':
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
description: Th
# --- truncated at 32 KB (141 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/posit/refs/heads/main/openapi/posit-content-api-openapi.yml