DynoStaticAdmin sign in
Documentation

Browser API

Browser API

DynoStatic ships physical PHP gateways so ordinary cPanel and aaPanel installations do not depend on rewrite rules. Browser embeds normally use api/index.php?action=…; internal routing translates each allowlisted action to a versioned resource.

Shared widget endpoints

  • GET api/index.php?action=widget&id=WIDGET_ULID&page=PAGE_URL returns the published widget payload.
  • GET api/?action=widget-data-table&widget=WIDGET_ULID returns one bounded search/sort/page projection from an origin-authorized immutable Data Table publication.
  • GET api/?action=widget-directory&widget=WIDGET_ULID returns one bounded search/category/page projection from an origin-authorized immutable Searchable Directory publication.
  • GET api/?action=widget-knowledge-base&widget=WIDGET_ULID returns one bounded search/category/page projection from the exact immutable CMS collection release referenced by an origin-authorized widget publication.
  • POST api/index.php?action=ticket issues a short-lived action ticket.
  • POST api/index.php?action=action performs an allowlisted widget action.

Published payloads distinguish Ready, official-embed, link-only, preview, credential-required, approval-required, and deferred modules. Only genuinely creatable modules can reach public runtime.

Discussion endpoints

The comments runtime uses bootstrap, thread, search, all-comments, replies, comment create/edit/delete, comment and page reactions, reports, private participant state, Markdown preview, identity exchange/account operations, subscriptions, and counts. The gateway rejects unknown actions at /api/v1/invalid.

Public writes require the registered exact origin and, where applicable, a signed visitor identity, browser proof, short-lived form ticket, idempotency identifier, and Turnstile result. CORS preflight includes every supported write method and authentication header.

Read versions and caching

Bootstrap is private and uncached. Public discussion reads can include the signed rv value returned by bootstrap. A read version binds website settings, page content, engagement totals, ranking when relevant, serializer version, and page identity. If data changes between pages, the API returns a fresh version and the comments runtime retries once instead of mixing snapshots.

Versioned public reads return an ETag and short public cache lifetime with stale-while-revalidate. Unversioned reads, private participant state, tickets, writes, admin, forms, consent, and credentials are never edge-cache candidates. Conditional requests accept weak ETags, comma-separated validators, and wildcard matching.

Knowledge Base ETags bind the widget publication, release public ULID, normalized schema hash, exact member-manifest hash, and response projection. The query accepts only q (at most 120 characters), category, page, and page_size (10 or 20); it returns at most 20 sanitized scalar records and never accepts or returns a CMS Bearer token.

Error shape

API failures return JSON with a stable machine code and a human message. Installation-start failures include a request ID that can be matched to the protected application log. Clients must not infer private moderation or anti-spam evidence from a generic pending response.

Direct client caution

Use the supported embed runtime unless a documented integration explicitly requires otherwise. Do not copy signed tokens between origins, store visitor or identity credentials in server logs, cache private responses, or invent gateway actions.