REST API

import { createDynamicHandlers } from "nextly/runtime";
import nextlyConfig from "../../../nextly.config";

const handlers = createDynamicHandlers({ config: nextlyConfig });

export const { GET, POST, PUT, PATCH, DELETE, OPTIONS } = handlers;

export { GET, HEAD } from "nextly/api/health";

curl https://example.com/api/collections/posts/entries \
  -H "Authorization: Bearer sk_live_abc123..."

{
  "items": [ /* T[] */ ],
  "meta": {
    "total": 42,
    "page": 1,
    "limit": 10,
    "totalPages": 5,
    "hasNext": true,
    "hasPrev": false
  }
}

{
  "id": "abc-123",
  "title": "Hello world",
  "status": "published",
  "createdAt": "2026-01-15T10:30:00.000Z",
  "updatedAt": "2026-01-15T10:30:00.000Z"
}

{
  "message": "Posts updated.",
  "item": {
    "id": "abc-123",
    "title": "Hello world",
    "status": "published"
  }
}

{
  "message": "Logged in.",
  "user": { "id": "user-1", "email": "user@example.com" },
  "token": "eyJ..."
}

{
  "message": "Bulk delete completed.",
  "items": [ { "id": "post-1" }, { "id": "post-2" } ],
  "errors": [
    { "id": "post-3", "code": "NOT_FOUND", "message": "Resource not found." }
  ]
}

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found.",
    "requestId": "req_nlwxzwtnlvqsu3lc"
  }
}

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Validation failed.",
    "requestId": "req_xxx",
    "data": {
      "errors": [
        { "path": "email", "code": "INVALID_EMAIL", "message": "Email is invalid." }
      ]
    }
  }
}

curl -i http://localhost:3000/api/health

HTTP/1.1 200 OK
content-type: application/json
cache-control: public, max-age=60, stale-while-revalidate=30
x-request-id: req_xxx

{
  "ok": true,
  "version": "0.0.142",
  "uptime": 123,
  "timestamp": "2026-05-05T09:00:00.000Z",
  "database": { "ok": true, "dialect": "postgresql", "latency": 4 }
}

{
  "error": {
    "code": "SERVICE_UNAVAILABLE",
    "message": "Service unavailable. Please try again later.",
    "requestId": "req_xxx"
  }
}

# Login
curl -i -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"secure-password"}'

# Register
curl -X POST http://localhost:3000/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"new@example.com","password":"secure-password","name":"New User"}'

# Forgot password
curl -X POST http://localhost:3000/api/auth/forgot-password \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'

# Reset password
curl -X POST http://localhost:3000/api/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{"token":"<token-from-email>","password":"new-secure-password"}'

# Change password (authenticated)
curl -X PATCH http://localhost:3000/api/auth/change-password \
  -H "Content-Type: application/json" \
  -b "__nextly_access_token=..." \
  -d '{"currentPassword":"old","newPassword":"new-secure"}'

# Verify email
curl -X POST http://localhost:3000/api/auth/verify-email \
  -H "Content-Type: application/json" \
  -d '{"token":"<token-from-email>"}'

curl http://localhost:3000/api/auth/setup-status
# {"ok":true,"completed":false}

curl -X POST http://localhost:3000/api/auth/setup \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@example.com","name":"Admin","password":"strong-password"}'

curl "http://localhost:3000/api/collections/posts/entries?limit=10&page=1&sort=-createdAt&where[status][equals]=published"

{
  "items": [
    { "id": "abc-123", "title": "Hello world", "status": "published" }
  ],
  "meta": {
    "total": 42,
    "page": 1,
    "limit": 10,
    "totalPages": 5,
    "hasNext": true,
    "hasPrev": false
  }
}

curl "http://localhost:3000/api/collections/posts/entries/abc-123?depth=2"

{
  "id": "abc-123",
  "title": "Hello world",
  "author": { "id": "user-1", "name": "John Doe" },
  "createdAt": "2026-01-15T10:30:00.000Z",
  "updatedAt": "2026-01-15T10:30:00.000Z"
}

curl -X POST "http://localhost:3000/api/collections/posts/entries" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"title":"New Post","content":"Hello!","status":"draft"}'

{
  "message": "Posts created.",
  "item": { "id": "...", "title": "New Post", "status": "draft" }
}

curl -X PATCH "http://localhost:3000/api/collections/posts/entries/abc-123" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"status":"published"}'

curl -X DELETE "http://localhost:3000/api/collections/posts/entries/abc-123" \
  -H "Authorization: Bearer sk_live_..."

curl "http://localhost:3000/api/collections/posts/entries/count?where[status][equals]=published"
# {"total": 42}

curl -X POST "http://localhost:3000/api/collections/posts/entries/abc-123/duplicate" \
  -H "Authorization: Bearer sk_live_..."

curl -X POST "http://localhost:3000/api/collections/posts/entries/bulk-delete" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ids":["post-1","post-2","post-3"]}'

{
  "message": "Bulk delete completed.",
  "items": [{ "id": "post-1" }, { "id": "post-2" }],
  "errors": [
    { "id": "post-3", "code": "NOT_FOUND", "message": "Resource not found." }
  ]
}

curl -X POST "http://localhost:3000/api/collections/posts/entries/bulk-update" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ids":["post-1","post-2"],"data":{"status":"archived"}}'

curl -X PATCH "http://localhost:3000/api/collections/posts/entries" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"where":{"status":{"equals":"draft"}},"data":{"status":"archived"}}'

curl http://localhost:3000/api/singles

curl http://localhost:3000/api/singles/site-settings

curl -X PATCH http://localhost:3000/api/singles/site-settings \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"siteName":"My New Site","maintenanceMode":false}'

curl -X POST http://localhost:3000/api/email/send \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "to": "user@example.com",
    "subject": "Hello",
    "html": "<p>Welcome to Nextly</p>"
  }'

curl -X POST http://localhost:3000/api/email/send-with-template \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "to": "user@example.com",
    "template": "welcome-email",
    "variables": { "name": "Alice" }
  }'

curl http://localhost:3000/api/api-keys -b "__nextly_access_token=..."

?where[status][equals]=published
?where[price][greater_than]=100
?where[title][contains]=hello
?where[category][in]=news,featured

?where[and][0][status][equals]=published&where[and][1][category][equals]=news

?sort=-createdAt
?sort=title

?limit=20&page=2

?depth=0   # IDs only
?depth=1   # populate direct relationships
?depth=2   # populate one level deeper

?select=id,title,publishedAt

?richTextFormat=html       # rendered HTML
?richTextFormat=json       # Lexical JSON (default)
?richTextFormat=both       # { json, html }

async function fetchPosts(page = 1) {
  const params = new URLSearchParams({
    limit: "10",
    page: String(page),
    sort: "-createdAt",
    "where[status][equals]": "published",
    depth: "1",
  });

  const response = await fetch(`/api/collections/posts/entries?${params}`, {
    credentials: "include",
  });
  const json = await response.json();
  return json; // { items, meta }
}