Environments and authentication
Source-reviewed draft; deployment and release verification pending.
Draft — source-reviewed on 22 October 2026. No development, staging or production endpoint has been verified for this handoff.
The Website Property API is a deliberately scoped, anonymous read interface. Search uses POST to carry a structured query; it does not create a property or change CRM records. These reviewed public operations do not require a CRM bearer token, user login or API key.
Never send a CRM access token to a website browser or include it in example code. An anonymous API still enforces publication, privacy, request-size and rate limits.
Environment configuration for frontend design
The configured API prefix in the reviewed source defaults to /api/v1. A confirmed deployment origin will be supplied separately. Until then, examples use an intentionally non-resolving origin:
https://website-api.example.invalid/api/v1This is a placeholder, not an available sandbox. Use local synthetic fixtures or a mock transport for React component work. Do not replace it with an internal CRM or staging hostname copied from repository files.
Browser access also depends on the approved origin configuration of the eventual deployment. CORS behavior and environment readiness require release verification. Do not use browser credentials as a workaround for a CORS failure.
Feature availability
The source configuration defaults both the public API and public media switches to disabled. Disabled routes return 404. A valid-looking URL therefore does not establish deployment readiness or prove that a listing is missing.
Enabling the public API alone does not enable public image delivery. Image endpoints also require the public media capability. Data preparation and publication eligibility remain separate gates.
The final approved environment handoff must state its origin, configured API prefix, allowed website origins, enabled capabilities and verification status. This draft does not assert any of those live settings.
ReadMe access and Try It
Documentation access is separate from API authentication. Restricted documentation does not add API credentials, and an anonymous API does not authorize public publication of the draft docs. Interactive calls to production must remain disabled during review. Use the reviewed draft definition and synthetic examples for design discussions.
Client behavior
Send JSON search bodies with Content-Type: application/json. Do not add unknown fields or explicit null filter values. Use the public URLs returned in image DTOs; they may be relative to the approved API origin. Handle unavailable service, missing media and disabled feature states as described in Errors and pagination.
Related operations
All five operations in the Introduction use this anonymous public boundary. No CRM login operation is part of this API definition.
Updated 1 day ago