CommunityNew About Us Insights
Support
Sign In
Developer Reference

The Websity Branding API.

A JSON REST interface over brand collections, project requests, assets, messaging, notifications, feedback, and webhooks. Authenticate with a JWT and every endpoint follows the same conventions.

Interactive Swagger UI OpenAPI Schema
# obtain a token
$ curl -X POST /api/branding/auth/token/ \
-H "Content-Type: application/json" \
-d '{"username":"...","password":"..."}'
# then call a resource
$ curl /api/branding/requests/ \
-H "Authorization: Bearer $ACCESS"
Base URL
/api/branding/
Version
1.0.0
Authentication
JWT Bearer
Page Size
20 (max 100)
Getting started

Three steps to your first response.

Every endpoint requires an authenticated user. Unauthenticated requests are rejected before any business logic runs.

01
Request a token

POST your credentials to the token endpoint to receive an access token and a refresh token. Access tokens are valid for 30 minutes.

02
Send it as a bearer

Pass the token in the Authorization header on every call. Refresh tokens are valid for 7 days and rotate automatically when used.

03
Read the response

List endpoints return a paginated object with results, count, next, and previous. Single-object endpoints return the resource directly.

Authentication

Token-based access.

Authentication uses JSON Web Tokens. Tokens are issued against a user account and carry the permissions needed for the resources you access. Staff-only actions are enforced server-side and return 403 for authenticated non-staff users.

POST /api/branding/auth/token/ Obtain pair
POST /api/branding/auth/token/refresh/ Refresh
POST /api/branding/auth/token/verify/ Verify

Session authentication is also enabled for the browser-based dashboard, so the same endpoints back both the UI and external integrations.

# Python example
import requests
 
BASE = "https://your-domain/api/branding"
 
t = requests.post(
    f"{BASE}/auth/token/",
    json={"username": u, "password": p})
 
headers = {
    "Authorization": f"Bearer {t.json()['access']}"
}
 
r = requests.get(
    f"{BASE}/requests/",
    params={"status": "in_progress",
        "page_size": 50},
    headers=headers)
 
print(r.json()["count"])

Keep access tokens out of client-side code and logs. Because refresh tokens rotate, always persist the new refresh token returned alongside a refreshed access token.

Resources

Eight collections, one convention.

All paths are relative to /api/branding/. Read-only collections expose list and retrieve; writable ones add create, update, and partial update. Deletes are available on writable collections.

Resource Endpoint Access Filterable by
Collections /collections/ Read only category, industry
Requests /requests/ Full CRUD status, industry, designer, priority, collection
Assets /assets/ Full CRUD asset_type
Notifications /notifications/ Read only mark-read actions
Messages /messages/ Full CRUD request, sender, parent
Timeline /timeline/ Read only request, event_type
Feedback /feedback/ Full CRUD rating, would_recommend
Webhooks /webhooks/ Full CRUD is_active
Custom actions

Domain operations on nested routes.

These sit under an individual object rather than the collection. Actions marked staff require a staff account and return 403 otherwise.

POST /requests/{id}/assign/ staff
POST /requests/{id}/update-status/ staff
GET /requests/{id}/timeline/
GET, POST /requests/{id}/messages/
GET, POST /requests/{id}/feedback/
POST /notifications/{id}/mark-read/
POST /notifications/mark-all-read/
POST /feedback/{id}/respond/ staff
POST /webhooks/{id}/test/ staff
GET /webhooks/{id}/deliveries/
Conventions

Query parameters and limits.

The same query parameters work across every list endpoint, so you can paginate, search, and order without learning new rules per resource.

Pagination
?page=2&page_size=50

Default page size 20, maximum 100. Responses include count, next, and previous.

Search
?search=acme

Full-text search across the searchable fields of that resource, for example company_name on requests or name on collections.

Ordering
?ordering=-created_at

Prefix a field with a minus sign to sort descending. Use a comma to sort on more than one field.

Rate limits
1000/hour per user

Authenticated requests are throttled at 1000 per hour per user, unauthenticated at 100 per hour. Exceeding the limit returns 429.

Need access, or a custom endpoint?

API credentials are provisioned per project. If you need an endpoint that is not in this list, or a webhook contract for your system, we will scope it with you.

Request API Access Open Swagger UI
Need some help?