HTTP API and error codes
All browser traffic stays under the host-owned base path /__copypatch/api/v2. Unsafe methods require an exact same-origin Origin header. Built-in sessions also require the current x-copypatch-csrf header.
| Method | Path | Access | Result |
|---|---|---|---|
GET | /health | Public | { "status": "ok" } or { "status": "unavailable" } |
GET | /content/:locale | Public | Published ContentSnapshot; supports weak revision ETags |
POST, GET, DELETE | /session | Authentication flow | Create, read, or clear a session |
GET | /editor/:locale | editor or publisher | Full EditorSnapshot |
PUT | /editor/:locale/changes | editor | Save draft changes with expected revisions |
POST | /editor/:locale/publish | publisher | Promote drafts to published copy |
DELETE | /editor/:locale/drafts | editor | Discard drafts with expected revisions |
Errors
Errors use { "error": { "code", "message" } }. The public error codes are VALIDATION_ERROR, UNAUTHENTICATED, CSRF_FAILED, ORIGIN_REJECTED, RATE_LIMITED, REVISION_CONFLICT, UNSUPPORTED_OPERATION, INTERNAL_ERROR, and NOT_FOUND.
REVISION_CONFLICT returns the current editor snapshot so the client can reconcile its pending edits. Public content reads can return the most recent in-memory snapshot or an empty fallback when storage is temporarily unavailable.