REST API reference

Introduction

Use the Sitedropper REST API to create projects, deploy ZIP archives, follow aggregate operations, and manage release settings from scripts or CI.

Base URL

The documentation always follows the current stable contract. Use the pinned base URL below for predictable automation. The floating /api alias runs the same stable handlers without redirects.

Stable base URLhttps://api.sitedropper.com/api/v1

Floating alias: https://api.sitedropper.com/api

Authentication

Log in with an existing Sitedropper account, store the returned JWT securely, and send it in the Authorization header. MCP OAuth credentials are not REST bearer tokens.

Authorization: Bearer $SITEDROPPER_TOKEN

Make your first request

Exchange your account credentials for a token. Request bodies use JSON unless an endpoint explicitly documents multipart ZIP transfer.

cURL
curl --fail-with-body --request POST \
  --url "https://api.sitedropper.com/api/v1/auth/login" \
  --header "Content-Type: application/json" \
  --data '{
  "email": "[email protected]",
  "password": "correct-horse-battery-staple"
}'
Response · 200
{
  "user": {
    "id": "e6f56c4b-f13d-43aa-a495-486b2155fba1",
    "email": "[email protected]"
  },
  "token": "eyJhbGciOiJIUzI1NiIs…",
  "expires_at": "2026-08-21T22:30:00Z"
}

Responses and errors

Successful requests return JSON except documented 204 No Content responses. Asynchronous writes return 202 Accepted and an aggregate operation. Stable errors use a machine-readable envelope:

Error response
{
  "error": {
    "code": "invalid_request",
    "message": "project name is required",
    "request_id": "req_01J61Q9R3F",
    "details": {}
  }
}

Use Idempotency-Key on deployment writes that may be retried. Cursor-paginated calls return next_cursor; pass it unchanged as the next cursor.

ZIP upload limits

  • Canonical and direct-GCS ZIP maximum: exactly 100,000,000 archive bytes.
  • Proxied multipart ZIP maximum: exactly 95,000,000 archive bytes.
  • Proxied request envelope: 100,000,000 bytes including multipart overhead.
  • REST upload preparation defaults to proxied_multipart. Request direct_gcs_resumable explicitly.

API calls by category

Every stable REST call has a dedicated page with its parameters, response statuses, cURL example, and response example.

8 calls

Authentication

Account access, verification, and password recovery.

5 calls

Account and billing

Identity, plan entitlements, subscription state, and hosted billing sessions.

4 calls

Deployments

One-shot ZIP deployments and short-lived upload credentials.

4 calls

Operations

Aggregate deployment progress, logs, cancellation, and retry.

5 calls

Projects

Project creation, retrieval, settings, and deletion.

2 calls

Releases

Cursor-paginated deployment history and aggregate release detail.

5 calls

Domains

Customer-owned subdomain setup and reconciliation.

3 calls

Access

Email grants for private project sharing.

3 calls

Environment

Encrypted project environment variables and non-secret digests.