Scope: the REST API of the Content Hub SaaS tenant (the platform now marketed as "SitecoreAI DAM"; APIs still carry the Content Hub name), plus the adjacent Experience Edge GraphQL delivery APIs and event mechanisms. The SitecoreAI Agent API / Marketer MCP is covered only where it touches assets (see Integrations).

At a glance

API styles

Hypermedia REST/JSON over HTTPS (resources link to each other; clients are told to follow links rather than build URLs) S15. GraphQL only for Experience Edge Preview/Delivery (read-only, published or preview content) S47 S48.

Base URL(s)

Tenant: https://{tenant}.sitecorecontenthub.cloud/api/…; OAuth on the same host (/oauth/token, /oauth/authorize) S2 S16. Experience Edge: https://edge.sitecorecloud.io/api/graphql/v1 (Delivery), {tenant}/api/graphql/preview/v1 (Preview), https://edge.sitecorecloud.io/api/apikey/v1 (Token API), https://edge.sitecorecloud.io/api/admin/v1 (Admin) S47. Public links/Media Delivery Service on separate delivery hosts S52 S53. Unverified A SitecoreAI DAM guide shows https://{environment}.sitecore.cloud as base URL S93

Current version(s) & deprecations

Per-API versions in the catalog: Entities v2.0, Querying v3.0 (X-ApiVersion: 3; v2 still documented), Upload v2.0, Jobs v2.0, all others v1.0 S1. Deprecated/legacy: Upload API v1 (only used by the Creative Cloud connector) S1; Scroll API "slated to be deprecated" S28; legacy non-expiring X-Auth-Token discouraged S20

Auth methods

OAuth 2.0 via M.OAuthClient entities: authorization code, resource-owner password, refresh token (documented for REST) S16; client credentials (client type in the UI, declared as an OAuth flow in 10 of the 13 specs) S3 S22 Unverified (raw REST form not shown in the OAuth page). Legacy POST/api/authenticate → X-Auth-Token S20. Browser cookie sessions S19

Token lifetime / refresh

Access token 1 hour (expires_in: 3600); refresh token 90 days, rotated (store the new one) since 2024-06-14; expired tokens → 401 S16 S17 S18. Legacy token never expires S20

Scopes / permission model

No functional OAuth scopes (responses return scope: offline_access) S16. Rights = the Content Hub user behind the token (user-group policies, member security, privileges) S22 S62 S63. Impersonation via X-Impersonate header S25

Official spec

13 OpenAPI 3.0 files on api-docs.sitecore.com (100 operations) S1–S14; archived copies on DAM Wiki: API spec downloads. Several REST resources (option lists, users/groups/policies, mass edit, fetch jobs, usage tracking, relations, DSL query) are prose-only S15. No official Postman collection (community ones exist S120 S121)

Rate limits

15 calls/second per API integration user (QA/PRD); 429 + Retry-After (wait ~30 s if absent) S23 S24. Dev tenants: 100 API calls/min (hard), 300 integration executions/min (soft) S23. Timeouts: request 140 s, keep-alive 60 s S15

Pagination

Collections chunked by 25 with next/previous links S26; skip/take ranging (limit per resource; too high → 403/500) S27; Querying API capped at 10,000 results S1; SearchAfter (cursor, recommended for large sets) S28 S30; Scroll (snapshot, being deprecated) S29; Search API default 50/page × 100 pages S40

Webhooks / events

No generic webhook registry for DAM events. Options: triggers + actions (API call, Azure Service Bus / Event Hub, internal "M Azure Service Bus", scripts) configured in Manage S43 S44; External Data Feed to Kafka (GA 2026-08-07) S45 S89; Experience Edge Admin Webhooks API for publishing events S46

Official SDKs

.NET Web Client SDK Stylelabs.M.Sdk.WebClient 4.2.79 (Sitecore NuGet feed; built-in 429 retry) S49 S115; JavaScript SDK @sitecore/sc-contenthub-webclient-sdk 1.2.136 (npm; no throttling handling) S50 S114; ch-cli 1.1.109 S51 S116. No Python SDK found

Sandbox / trial access

No public sandbox or self-service trial. Customers get Dev/QA/PRD tenants; Dev tenants are rate- and size-limited S23. The api-docs "Try it" console targets your own {server} with your own token S1

Authentication

Where credentials come from S22

A superuser/admin opens Manage → OAuth clients → + OAuth Client and sets Name, Client ID, Client Secret, Redirect URL(s) (TLS required), Client Type and, for client-credentials clients, Users.
For the client-credentials type the token inherits all permissions of the associated user S22. Sitecore recommends one OAuth client per external application (to revoke independently) S22 and one dedicated API user per integration (or per block of a large integration) so load and errors can be attributed S23.
OAuth clients are themselves entities (M.OAuthClient with ClientName, ClientId, ClientSecret, RedirectUrl) S16.

Token endpoint S16: POSThttps://{tenant}.sitecorecontenthub.cloud/oauth/token, Content-Type: application/x-www-form-urlencoded.

Grant	Body	Notes
`authorization_code`	`grant_type`, `code`, `redirect_uri`, `client_id`, `client_secret`	Start at GET`/oauth/authorize?client_id=…&redirect_uri=…&response_type=code`; user signs in via `/en-US/Account` then is redirected with `code` S16
`password`	`grant_type`, `client_id`, `client_secret`, `username`, `password`	Resource-owner password; returns access + refresh token S16
`refresh_token`	`grant_type`, `client_id`, `client_secret`, `refresh_token`	Returns a new refresh token; persist it (the Web SDK exposes a `RefreshTokenReceived` event) S16 S17
`client_credentials`	`grant_type`, `client_id`, `client_secret` (standard RFC 6749 form)	Client type exists in the UI and specs declare a `clientCredentials` flow with `tokenUrl: /oauth/token` S3 S22; Unverified not shown on the REST OAuth page; whether a refresh token is returned is Unknown

Response: {scope: "offline_access", token_type: "Bearer", access_token, expires_in: 3600, refresh_token} with Cache-Control: no-store S16.

Sending the token: Authorization: Bearer {access_token} S16. The API reference pages say an access token and the client ID are sent with every request S1 Unverified (no client-ID header is named in the specs; examples only use the Bearer header).

Legacy token (discouraged) S19 S20 S21: POST/api/authenticate {"user_name","password"} → {"token"}, sent as X-Auth-Token; never expires; one token per user; PUT/api/authenticate {"user_name"} (superuser) regenerates it. The ManageAuthenticationTokens privilege manages all users' API tokens S63. Unverified A 2026 SitecoreAI DAM guide has superusers create per-user "API tokens" in Manage → Users → API token → New token for a third-party integration S93 — likely this token family, not confirmed.

Experience Edge uses separate API keys sent as X-GQL-Token, managed through the Token API S47; they do not replace OAuth for the tenant REST API Unverified (inferred; not stated explicitly).

Core resources

Paths are relative to https://{tenant}.sitecorecontenthub.cloud. "Spec" = present in the OpenAPI files; "Prose" = documented only at doc.sitecore.com.

Resource	Endpoints	Notes
Service root	GET`/api`	Hypermedia entry point listing collection links and URI templates; supports ETag / `If-None-Match` S15 S25 (prose)
Entities (assets, files, taxonomy items, users, settings… all are entities)	`GET`/`PUT`/DELETE`/api/entities/{id}`; same on `/api/entities/identifier/{identifier}`; POST`/api/entities`; GET`/api/entitydefinitions/{name}/entities`	GET params `culture`, `cultures`, `groups`, `members`, `renditions`, `nestedRelations`, `loadPermissions`. PUT sets omitted properties/relations to null S2
Relations	`GET`/PUT`/api/entities/{id}/relations/{relationName}`	Replaces the whole relation S15 (prose)
Lifecycle (approval workflow)	GET`/api/entities/{id}/lifecycle`; POST`…/lifecycle/{submit\|directpublish\|approve\|reject\|archive\|restore\|restorefromdelete\|softdeleteentity}`	S2
Renditions	`GET`/POST`/api/entities/{entityId}/v2.0/renditions`; GET`…/renditions/GetUserRenditionsCount`	S2
Metadata schema	GET`/api/entitydefinitions` (`take` ≤ 100, `viewMode`, `includeConditionalMembers`, `definitionsToLoadByName`, `exclude*`), GET`/api/entitydefinitions/{name}` (`If-Modified-Since`), `/name/{name}` (v2), `/{id}`; `POST`/`PUT`/DELETE`/api/entitydefinitions/{name}`; POST`/api/entitydefinitions/{name}/impact` (impact of a schema change)	S3
Option lists	GET`/api/datasources`, `GET`/`PUT`/DELETE`/api/datasources/{name}`, POST`/api/datasources`	Former "Data Sources" name kept in the path S41 (prose)
Querying (bulk read)	POST`/api/entities/query`, POST`/api/entities/scroll`, POST`/api/entities/searchAfter` (header `X-ApiVersion: 3` or `2`); legacy GET`/api/entities/query?query=…` (DSL) and GET`/api/entities/searchafter` (v1)	Query capped at 10,000 results S1 S4 S5 S31 S32
Search (UI-style search, facets, aggregations)	`GET`/POST`/api/search`, POST`/api/search/allfacets`, POST`/api/search/remove`, GET`/api/search/{id}`	Applies the tenant's default search configuration (default filters/values) S1 S6
Selection	`GET`/DELETE`/api/selection/{selectionPool}/{definitionName}`, `POST`/PATCH`/api/selection`	Max 5,000 selected entities (configurable) S1 S11
Uploads	POST`/api/v2.0/upload` → POST`/api/v2.0/upload/process?…` (signed URL) → POST`/api/v2.0/upload/finalize`	S7 S35
Fetch jobs (server-side ingest from URLs)	POST`/api/fetchjobs` (+ get/list/update, files)	S38 (prose)
Downloads	`GET`/POST`/api/downloadorders`, GET`/api/downloadorders/{id}`, `…/{orderId}/targets[/{entityId}]`	Zip download orders S12
Jobs / mass edit	GET`/api/v2/jobs/{id}`; `/api/jobs/{id}/targets[/bulk\|/{targetId}]`; `/api/jobs/{id}/description`; `/api/massedits`	Mass-edit jobs over entities of one definition S8 S39
Users & groups	Entities of definitions `User` and `UserGroup` (relation `UserGroupToUser`); legacy GET`/api/users[/{id}]`, GET`/api/usergroups[/{id}]`	S130 (prose pages "User", "User group")
Policies (rights)	`GET`/`HEAD`/POST`/api/policies/{id}` (one policy per user and per group)	Rules → conditions → permissions S130 (prose) S62
Rights (DRM)	Rights profiles and DRM contracts are entities; no dedicated REST resource documented	S83; REST shape Unknown
Audit logs	GET`/api/audit/{action\|business\|raw\|raw/operational\|scripting\|trigger}/query/{entityId}` and `/scroll/{entityId}`; POST`…/generate` (download order); POST`/api/audit/business/aggregate`	`Take` ≤ 100; filters `EventTypes`, `Username`, `Definition`, `From`/`To`, `FullText`… S9
Status & usage	GET`/api/status[/system\|users\|queues\|jobs/{retention}\|servicestatus\|datastorage\|mediastorage\|videoindexing\|search\|graph]`; GET`/api/usagetracking?start=YYYY-MM&end=YYYY-MM`	`status/users` → `{total_user_count, active_user_count}` S10 S42
Admin utilities	DELETE`/api/cache/{name}`; GET`/api/graph/v1/rebuilds`	S13 S14
Workflows	Lifecycle endpoints above; state flows are configured entities (no dedicated REST resource documented)	S73
Experience Edge (delivery)	GraphQL Preview/Delivery (no mutations), Token API, Admin API incl. `/webhooks`	S46 S47 S48

Data model

Everything is an entity of an entity definition. A definition has member groups containing properties (typed values) and relations (links to other entities, with role Parent/Child and cardinality) S3 S60.
Identifiers: numeric id (incremental, deployment-specific) and string identifier (stable across environments; use it for integrations, imports, exports) S34. Creation returns Location and X-Global-Identifier headers S24 S25.
Assets: definition M.Asset; files are linked entities (main file + alternative files; replacing the main file moves the old one to file history) S35 S38. Default renditions: Original, Metadata (ExifTool JSON), PDF, Preview, Medium, Thumbnail, Big thumbnail; Original/Metadata/Preview/Thumbnail are "essential" S58 S136.
Taxonomies: entities of taxonomy definitions (hierarchical, unlimited depth) linked to assets by relations named ParentToChild (e.g. BrandToAsset); option lists are separate flat/hierarchical value lists (/api/datasources) S61 S32 S41.
Multilingual values: multilanguage properties are keyed by culture; the dev docs say a GET without culture returns all cultures S33, while the Entities v2 spec says multilanguage properties are not included without a culture S2 Unverified (contradiction — always pass culture/cultures).
Lifecycle: assets carry a final lifecycle status driven by the lifecycle operations (Created, Under review, Approved, Rejected, Archived, deleted/restored) S2; audit events mirror them (lifecycle.created, lifecycle.approved, lifecycle.archived…) S57.
Users/groups/settings/OAuth clients are entities too (User, UserGroup, M.OAuthClient, settings) S16 S130.
Load shaping: without members/load configuration, all members are returned (expensive) — request only what you need S1.

Search & querying

Four mechanisms coexist S1 S4 S5 S6 S30 S32:

Mechanism	Syntax	Limits / notes
Query DSL (v1)	GET`/api/entities/query?query=Definition.Name=='M.Asset' AND …&skip=&take=&members=` — typed property filters, `Parent('Rel').id==…`, `Exists('Rel')` / `Missing('Rel')`, `FullText=='…'`	Restrict by definition for performance; 10,000-result cap S32 S1
Querying API v2 (`X-ApiVersion: 2`)	POST`/api/entities/query` with a flat body `{filter, skip, take, sorting, scroll_time, load_configuration}`; filter types Composite, Not, Property, Relation, CreatedBy/ModifiedBy, SecuredAncestors, Id, Identifier, Definition, Modules, CreatedOn/ModifiedOn	10,000 cap; sort ties are random — add a tie-breaker S5
Querying API v3 (`X-ApiVersion: 3`, current)	Body wrapped as `{query: {filter, skip, take, sorting, scroll_time}, load_configuration}`; `fulltext` filter not supported in v3	S4
SearchAfter (v3)	POST`/api/entities/searchAfter` `{filter, sorting, search_after, take, load_configuration}`; filter nodes Negating, Logical, DefinitionName/Id, RootTaxonomyItem, PathRoot, Locked, CreatedBy, ModifiedBy, FullText, Identifier, IdIn, Selection, typed property filters, Relation, RelationExists, Ancestor; response carries `last_hit_data` to send back	Recommended for large result sets; sort on a unique field S4 S28 S30. v1 GET variant: `take` default 25, max 100 S31; v3 max `take` Not public
Search API	POST`/api/search` `{query, skip, take, filters[], sorting, aggregations[], fulltext[], culture, defaults, visualSearch…}`	Applies the default search configuration; default 50 items/page, 100 pages S1 S6 S40

Filter operators (Search API): Equals, Contains, StartsWith/EndsWith (+ negations), Between, Less/GreaterThan(OrEquals), AnyOf/AllOf/NoneOf, Missing, Exists, Changed, FacetEquals S6.
Aggregations: {name, field, size, type: Term|Metric|Date, interval, format, include_missing, children[], metric_option, datasource} S6; response format and index field naming are not documented in the spec — Unknown Unverified.
Facets: returned per the search configuration; POST/api/search/allfacets returns all values of one facet S1 S6.
Visual search parameters are accepted by the Search API S1.
Cheap counts: collection responses carry total_items S26.

Uploads & binaries

Upload API v2 (three steps) S7 S35 S36 S37

POST/api/v2.0/upload {file_name, file_size, action: {name, parameters}, upload_configuration: {name}} → signed upload URL in the Location header + {upload_identifier, storage_identifier, file_identifier}. Actions: NewAsset, NewMainFile (new version; AssetId), NewAlternativeFile (AssetId), Import (packages, localisations, data). Configurations: AssetUploadConfiguration, ImportPackageConfiguration, ImportLocalizationsConfiguration, ImportDataConfiguration.
POST the file as multipart form-data to the Location URL (/api/v2.0/upload/process?key=…&expires=…&signature=…); files > 10 MB are sent in ≤ 10 MB chunks with chunks=N&chunk=i (0-based), then a final call with only chunks=N.
POST/api/v2.0/upload/finalize with the step-1 identifiers → {success, message, …}.

Upload URL lifetime: the Upload page says 5 minutes by default S35, the configuration page says default 10 S37 Unverified (contradiction); both allow up to 1,440 minutes via upload_url_lifetime_in_minutes on M.UploadConfiguration.
Maximum file size set per upload configuration (Azure Blob ceiling 4.7 TB) S35.
Not for bulk: high volumes of parallel uploads hurt tenant performance; use fetch jobs (POST/api/fetchjobs with asset link + files[] URLs; last file becomes the master) or Excel import S56 S38.

Downloads & renditions

Rendition links on entities (renditions= parameter) and /api/entities/{id}/v2.0/renditions S2.
Delivery links: pre-signed Media Delivery Service URLs https://{host}/api/delivery/{apiVersion}/{tenantId}/{key}?expires…&signature…, valid ~20 minutes S84 S53.
Gateway links: https://{tenant}/api/gateway/identifier/{id}/preview — require an authenticated user / OAuth token S84.
Public links: unsigned https://{host}/api/public/content/{relativeUrl}?v=…, optional expiry, 10-minute cache; on-the-fly media transformations with transform=true (JPEG, PNG, GIF, WebP, HEIC) S52 S70.
Download orders for multi-asset zips S12.

Events & webhooks

Triggers + actions (in-platform, UI-configured) S43 S44

Triggers evaluate every create/update/delete event, with conditions on properties/relations, and run actions asynchronously.
Action types: API call (POST/PUT/GET to any URL, timeout, headers and body values templated from the entity, bulk execution; headers ≤ 64 KB, values ≤ 256 KB; multilanguage properties not supported), Azure Event Hub, Azure Service Bus (queue/topic, bulk), M Azure Service Bus (Content Hub-provided bus with read-only "Hub out" connection string), action scripts, print entity generation, reporting channel, start state machine.
Configuration is done in Manage → Triggers / Actions; since triggers and actions are stored as entities, programmatic management is possible in principle but not documented Unverified.
Payload signing: none documented; authentication is via custom headers on API-call actions S44. Retry policy: Unknown in the pages read.

External Data Feed (Kafka) S45 S89

GA 2026-08-07. Content Hub acts as a Kafka producer (works with Azure Event Hubs' Kafka endpoint). Settings category ExternalDataFeed: Export (list of entity definitions) and Transport (kafka.enabled, bootstrapServers on ports 9092/9093, topic, clientId, securityProtocol SaslSsl/SaslPlain, SASL user/password).
Envelope {tenant, event_type, payload}; events entity.saved (changed members only), entity.deleted, entity.initialized (emitted by "Re-export all" / per-definition re-export for a baseline).
Not a replacement for audit logs, which remain the source of truth.

Experience Edge webhooks S46: Admin Webhooks API (/webhooks CRUD) fires on publishing (OnEnd default, OnUpdate with entity changes batched); HTTPS only; auto-disabled after 10 consecutive failures (> 30 s counts as failure).

Polling alternatives: SearchAfter with ModifiedOn filters S4; Audit API queries/scroll S9.

Limits & quirks

Topic	Detail
Rate limit scope	15 req/s is per API integration user; throttling is not licence-based; REST and JS SDK do not retry, the .NET Web SDK retries 429 nine times (`RetryCount`)	S23 S49 S50
Rate-limit headers	Only `Retry-After` is documented; no `X-RateLimit-*` headers	S23 Unverified (absence)
Dev tenants	100 calls/min hard; 10,500 custom + 10,500 taxonomy entities (403 "Entity limit reached"); audit kept 2 weeks	S23
404 semantics	Specs describe 404 as "Entity not found or user not authorized" — a 404 may hide a permission problem	S2 S3 S8
403 semantics	Validation errors, access violations, too-large `take`, Dev entity cap	S24 S27 S23
Error bodies	Error object is a dictionary keyed by the failing property (e.g. `{"IPMS": "…validation expression"}`) with an optional `Message` object; key names therefore vary — parse defensively	S24 S140
PUT semantics	Omitted properties/relations are set to null on PUT`/api/entities/{id}` — send complete member sets or scope with `members`/`groups` Unverified (scoping effect not stated)	S2
Culture default	Docs vs spec contradiction on whether multilanguage values are returned without `culture`	S2 S33 Unverified
Upload URL lifetime	5 vs 10 minutes default depending on the page	S35 S37 Unverified
Query cap	Querying API: max 10,000 results; use SearchAfter beyond	S1
Querying v3	No `fulltext` filter in v3; body shape differs from v2 (wrapped in `query`)	S4 S5
Schema changes	Publishing schema changes can trigger a graph rebuild that pauses regular operations	S60
Performance guidance	< 50 relations and < 100 members per definition, < 100 member groups, < 3 nested relations, ≤ 100 user groups with < 100 policies each	S56
Selections	Max 5,000 entities per selection (configurable)	S1
Audit exports	Raw/reporting log exports up to 500,000 rows (configurable)	S9
Timeouts	API timeout 140 s, keep-alive 60 s	S15
Comment HTML sanitisation	When the opt-in `CommentHtmlSanitization` PortalConfiguration setting (2026-10-02) is enabled, comments created through direct API calls are also filtered against the allowed tags/attributes/CSS and trusted image hosts. The changelog does not describe how filtered content or rejections surface in API responses — test integrations that post rich-HTML comments before enabling it	S163 Unverified (response behaviour not documented)
Package import/export (CLI / CI)	Packages are moved between environments with `ch-cli system export` / `system import` (`ExportPackageCommand` / `ImportPackageCommand`; flags not listed in the reference) or the UI; package files are the `Import` action of the Upload API with `ImportPackageConfiguration` S149 S7. A new import/export engine (beta 2025-06-13, up to 4x faster) became the default in UI and CLI on 2025-10-06; the old engine was opt-out only for a transition period (CLI flag not named) S146 S148. Community reports the new package layout is grouped by resource type (one JSON file per resource), so pipelines and source-controlled baselines built on the old layout need refactoring S151. Do not hand-edit package folders S150. Package create/import emits raw audit events recording the engine used S147. 2026-09: the importer started skipping items identical in the target (2026-09-18) but that optimization was reverted on 2026-09-24 to fix an import/export issue — imports again process unchanged items, so do not rely on skip-unchanged behaviour in CI S144 S145	Official

SDKs, tools & code samples

Library / tool	Language	Maintainer	Status
Web Client SDK `Stylelabs.M.Sdk.WebClient`	.NET	Sitecore	4.2.79 on Sitecore's NuGet feed (not nuget.org); handles throttling; grants password / client credentials / refresh token	S49 S115
Scripting SDK / Fluent SDK	.NET	Sitecore	Scripting SDK used inside Content Hub scripts; Fluent SDK wrapper	S130
JavaScript SDK `@sitecore/sc-contenthub-webclient-sdk`	TypeScript/JS	Sitecore	1.2.136 (2026-09-29); proprietary licence; no built-in throttling	S50 S114
Content Hub CLI (`ch-cli`, NuGet tool `Sitecore.CH.Cli`)	.NET binary (Win/macOS/Linux), Docker image `scr.sitecore.com/sch/ch-cli`, .NET tool	Sitecore	1.1.109 (2026-03-19); serialization, package export/import (`system export` / `system import`, new engine default since 2025-10-06), audit log tail	S1 S51 S141 S148 S149 S116 S115
ContentHub.BulkTransfer.CLI	.NET	Sitecore (GitHub)	Example tool: serialises Content Hub content to SitecoreAI Content Transfer (RAIF) format; last push 2026-07-06	S117
ContentHub-VS-Solution-Example	.NET	Sitecore (GitHub)	Visual Studio starter kit; last push 2026-01-14	S118
Accelerate Cookbook + `accelerate-content-hub`	Docs + code	Sitecore	Implementation recipes	S119
Postman collections	—	Community (shiham55; sergyatsenko)	Unofficial; not stored here	S120 S121
Uniform Mesh integration	TypeScript	Uniform	Asset picker; last push 2026-01-17	S122
awesome-content-hub	—	Community	Resource list; last push 2024-09-18	S123
Python SDK	—	—	None found	S114 Unverified (absence check)

Changelog of the API

Date	Change
2026-10-02	Opt-in `CommentHtmlSanitization` (PortalConfiguration) also enforced on API-posted comments; guarded state-flow transitions available as bulk actions in the Selection component	S163 S164
2026-09-24	Package import: the "skip unchanged items" optimization (2026-09-18) reverted to fix an import/export issue	S145
2026-09-18	Package importer skips items identical in the target (MONE-62006); fixes to import validation (MONE-62659), dry-run error messages (MONE-61186), state-flow taxonomy transfer (MONE-62203); trigger custom validation messages now returned in API responses (MONE-62853)	S144
2026-09-04	AI text generation can be enabled on fields of any entity definition; image-aware alt-text generation	S90 S91
2026-08-07	External Data Feed (Kafka) generally available	S89
2026-03-19	ch-cli 1.1.109 released	S116
Unknown	Querying API v3.0 becomes the default catalog version (`X-ApiVersion: 3`; no `fulltext` filter)	S1 S4
Unknown	Upload API v1 deprecated (kept only for Sitecore Connect for Creative Cloud)	S1
Unknown (announced)	Scroll API slated for deprecation; notice to come via changelog and SaaS Ops e-mail	S28
2025-10-06	New package import/export engine becomes default in UI and CLI (CI scripts to be updated; temporary opt-out)	S148
2025-07-11	Raw audit events for package creation and import	S147
2025-06-13	New import/export engine released in beta	S146
2024-06-14	Refresh tokens limited to 90 days (action required: persist rotated tokens)	S18
Legacy	POST`/api/authenticate` non-expiring token discouraged in favour of OAuth	S19 S20

Stored API specs

13 files · 585 KB · verbatim copies of public vendor filesSpecs README & provenance

File	Format	Size	Download
`sitecore-ch_openapi_audit-api_v1.0.json`	OpenAPI	207 KB	Download
`sitecore-ch_openapi_cache-api_v1.0.json`	OpenAPI	3.5 KB	Download
`sitecore-ch_openapi_download-orders-api_v1.0.json`	OpenAPI	23 KB	Download
`sitecore-ch_openapi_entities-api_v2.0.json`	OpenAPI	60 KB	Download
`sitecore-ch_openapi_entity-definitions-api_v1.0.json`	OpenAPI	32 KB	Download
`sitecore-ch_openapi_graph-api_v1.0.json`	OpenAPI	7.4 KB	Download
`sitecore-ch_openapi_jobs-api_v2.0.json`	OpenAPI	43 KB	Download
`sitecore-ch_openapi_querying-api_v2.0.json`	OpenAPI	48 KB	Download
`sitecore-ch_openapi_querying-api_v3.0.json`	OpenAPI	49 KB	Download
`sitecore-ch_openapi_search-api_v1.0.json`	OpenAPI	31 KB	Download
`sitecore-ch_openapi_selection-api_v1.0.json`	OpenAPI	16 KB	Download
`sitecore-ch_openapi_status-api_v1.0.json`	OpenAPI	48 KB	Download
`sitecore-ch_openapi_upload-api_v2.0.json`	OpenAPI	17 KB	Download

Sitecore Content Hub API