
The headless REST APIs are well structured and documented through OpenAPI and the API Explorer. Structured content, documents and custom objects are all available through consistent endpoints, with pagination, filtering and nestedFields. Role and permission checks apply to the APIs too, so guests, logged-in users and role-specific users each get only what they’re allowed to see. OAuth 2 with scoped tokens makes service-to-service integration straightforward. Review collected by and hosted on G2.com.
Permission troubleshooting is the hardest part. A 403 or an empty list can come from a site-scope mismatch, a missing View permission on a structure or document, or a token scope issue, and there’s no clear way to see which one. The docs and Postman collections also don’t always match real API responses, so I end up verifying field names and nesting myself. Behavior changing between versions makes upgrades harder. Review collected by and hosted on G2.com.