Website content API and webhooks

Read published content with a Winglo API key and configure outbound content webhooks.

Winglo can expose published website content to your own front end. This feature is gated by workspace entitlement and management permission.

Issue an API key#

Open Marketing, then Website → Settings → Integrations. Under Headless API keys:

Enter a key name.
Choose the read scope for content delivery.
Choose Issue key.
Copy the secret immediately.

The secret is shown once. Winglo stores only its hash and cannot show it again. Put the key in a server-side secret store. Never include it in browser code or a public repository.

Revoke a key from the same panel when it is no longer needed. Create and deploy a replacement before revoking a key that serves live traffic.

Authenticate#

Send the key in an authorization header:

http

Authorization: Bearer wg_live_your_key

The production API origin is https://api.winglo.ai.

Read content#

Use these read endpoints:

text

GET /v1/content
GET /v1/content/:type
GET /v1/content/:type/:slug

Supported type values are:

blog
docs
case-studies
changelog
media

The collection endpoints accept page and limit. Page starts at 1. The default limit is 50 and the maximum is 100. On /v1/content, pagination applies to each content collection.

Each item has a common head with id, type, slug, title, status, and timestamps. Type-specific data is under fields. Only content eligible for published reading is returned.

Example:

bash

curl "https://api.winglo.ai/v1/content/blog?page=1&limit=20" \
  -H "Authorization: Bearer $WINGLO_CONTENT_KEY"

Handle these responses: 401 for a missing or invalid key, 403 for a missing scope, 402 when the workspace is not entitled, 404 for an unknown type or item, and 429 when requests are too frequent.

Add a content webhook#

In the same Integrations panel, add an HTTPS endpoint and choose an event. Events can include:

content.published
content.updated
content.archived
content.deleted

Winglo sends a POST request and includes x-winglo-event and x-winglo-signature headers. The panel also shows recent delivery state and errors. You can disable or delete a webhook.

The current settings view does not display the per-webhook signing secret. Do not claim that your receiver verifies the HMAC signature unless your Winglo environment has supplied that secret through an approved secure channel. Your endpoint must still use HTTPS, validate the event body, reject unexpected input, and make repeated delivery safe.

Troubleshoot integrations#

For 401, replace the key with the exact show-once secret.
For 403, issue a read-scoped key.
For 402, check the feature shown for the workspace.
For 404, check type and slug.
For 429, wait and reduce request frequency.
For webhook failure, open recent deliveries and inspect the last error.