Every endpoint you can use with an API key – sorted by area, with the method, path, required scope and what it does.
This overview lists every endpoint that works with a token from an API key. All paths start with https://dock.at-harbor.com. The exact fields of each endpoint are in the OpenAPI description at https://dock.at-harbor.com/openapi.yaml.
Current draft: template_key, config, theme_config, custom_css, seo, image assignments and links
PATCH /v1/pages/{id}/draft
write:pages
At least one of config (at most 64 KB as JSON, each text up to 5,000 characters), theme_config, custom_css (up to 50,000 characters and 65,535 bytes), seo, template_key, template_asset_bindings
Types you can create: text, image, embed, spacer, social_links, form, integration, donation, modal, heading, notice, coupon, contact, opening_hours, tour, file, vcard, countdown and gallery. The links block is fixed and is not created via this endpoint. The API rejects block types outside your plan with 403 block_type_requires_plan. A block's config may be at most 128 KB as JSON, and each text in it at most 10,000 characters; in the info modal, modal_body_html may have up to 50,000 characters and at most 65,535 bytes.
Create a link; required: title (1–200) and target_url_template (8–2048)
GET /v1/pages/{id}/links/{linkId}
read:links
One link
PATCH /v1/pages/{id}/links/{linkId}
write:links
Edit a link
DELETE /v1/pages/{id}/links/{linkId}
write:links
Delete a link
POST /v1/pages/{id}/links/reorder
write:links
Set the order: {"order":[IDs]}
Optional fields when creating and editing: enabled, geo (country rule with mode allowlist or denylist and countries), device (separate targets per device), starts_at and ends_at (scheduling), protection_tier (bot protection) and age_restriction. Scheduling, country and device rules are available from Creator Pro. When reordering, it is enough to send the IDs that should move to the front – all other links follow in their previous order. The API rejects IDs that do not belong to the page with 422 validation_failed; details.missing_link_ids lists them.
Create a form; required: name and fields (1–100 fields)
GET /v1/forms/{id}
read:forms
One form
PATCH /v1/forms/{id}
write:forms
Edit a form
DELETE /v1/forms/{id}
write:forms
Delete a form
GET /v1/forms/{id}/summary
read:forms
Summary
GET /v1/forms/{id}/submissions
read:forms
Submissions, newest first (limit 1–500, default 100; further pages via cursor = next_cursor)
GET /v1/forms/{id}/submissions/export
read:forms
All submissions as a CSV file, newest first, up to the plan's export limit (from Creator Pro); the X-Export-Truncated header shows whether it was cut short
You choose the period as described under Pagination, with period or with from and to. How far back you can look depends on the plan: 365 days in Creator Pro and Agency, 730 days in Enterprise. Older periods are cut back to this limit.
One callback secret (without the plain-text secret)
GET /v1/templates
read:workspaces
All templates
GET /v1/templates/available
read:workspaces
Built-in and active workspace templates with valid template_key values; workspace templates have the key ws:<key> and type workspace
GET /v1/templates/{key}
read:workspaces
One template
GET /v1/workspaces/me/templates
read:workspaces
Your own workspace templates
GET /v1/workspaces/me/templates/{id}
read:workspaces
One workspace template
POST, PATCH, DELETE /v1/workspaces/me/templates[/{id}]
write:templates
Create, edit, delete workspace templates; html at most 60,000 bytes (otherwise 422 validation_failed with details.reason maxBytes), up to 32 asset_slots
Webhooks, integrations, sending push notifications, managing domains, members, billing and deleting pages are only available in the dashboard. Callback secrets, too, can only be created and managed in the dashboard; listing and reading them (without the secret in plain text) works with read:workspaces. The complete list is in Scopes in detail. Incoming data – sales and your own live data – you send with separate secrets to the endpoints described in Callbacks.
