API Reference

POST /api/sites/deploy authenticates with a long-lived API token: Authorization: Bearer mcapi_.... Tokens are created in Settings → API, shown only once, expire after a configurable period (30 days by default), and can be revoked at any time. Requests that fail authentication return 401; accounts without API access or an accepted agreement return 403.

All other endpoints below authenticate with the signed-in browser session cookie. State-changing requests (POST, PUT, DELETE, PATCH) must also send the CSRF token — see CSRF protection. These routes are intended for the portal's own UI rather than external scripts.

Create a site programmatically with an API token (mcapi_...), bypassing Stripe checkout.

Restricted to approved customers who have accepted the API Service Agreement. Requires skipPayment: true; deployments are tracked and invoiced manually. See the API documentation for the full request/response contract.

List your sites.

Returns { customer, sites } for the signed-in account.

Get a single site.

Returns { site } including its status, domain, plan, and live_url.

Delete a site (irreversible).

Cancels the Stripe subscription if one exists, soft-deletes the site record, and triggers infrastructure cleanup. Returns { success, site_id, subscription_cancelled, refund }.

Publish the latest build.

Pushes the most recent AI-builder build live to the site hostname.

Create a data export of the site.

Get usage metrics for the site.

Change the site plan.

Request body: { "newPlanId": "starter" | "professional" | "enterprise" | "free" }.

List your data exports.

List invoices.

Supports limit and offset query parameters. Returns { invoices, total, limit, offset, has_more }.

Create a Stripe Customer Portal session.

Returns { url } pointing to the Stripe portal for managing payment methods and billing details.