Strapi

The API is auto-generated from content type definitions. REST: GET /api/{content-type} for listing with filtering, sorting, and pagination. GET /api/{content-type}/{id} for single entry. POST for creation, PUT for update, DELETE for deletion. Filters use qs library format: ?filters[field][$eq]=value with operators ($eq, $ne, $lt, $gt, $contains, $in, etc.). Population (relation loading) uses ?populate=* or selective population. GraphQL plugin generates typed schema from content types. The API design follows Strapi's conventions rather than pure REST — the filter syntax is powerful but non-standard. Media upload uses multipart form data with the Upload plugin. Custom controllers and routes enable API extension. Internationalization adds locale-based content retrieval.

API errors return JSON with error object containing status, name, message, and details (field-level validation). Standard HTTP status codes. Rate limiting depends on deployment configuration — Strapi itself doesn't impose rate limits, but reverse proxies (nginx, Cloudflare) in front typically do. Content type validation errors return field-specific messages. The self-hosted model means reliability is the operator's responsibility: database availability (PostgreSQL, MySQL, SQLite), Node.js process management, and file storage. Strapi Cloud handles these concerns. The main consideration for agents: Strapi instances vary widely in performance and configuration — agents must handle the variability of self-hosted environments. Plugin conflicts can cause unexpected behavior.

Strapi is the most popular open-source headless CMS — self-hosted on Node.js with automatic REST and GraphQL API generation from content type definitions. For agents, the auto-generated API means defining a content type (e.g., 'Article' with title, body, author, category) automatically creates CRUD endpoints. The Content Types Builder provides a visual interface or code-based schema definition. Strapi Cloud offers managed hosting. The plugin ecosystem adds authentication, internationalization, upload management, and custom functionality. For agents in environments requiring self-hosted CMS (data sovereignty, compliance), Strapi provides full infrastructure control. The trade-off versus Contentful/Sanity: lower operational overhead with managed services, but full control with self-hosted. API customization enables agents to add custom endpoints and middleware.

Two auth paths: API tokens (for machine access) and JWT (for user-based access). API tokens are created in the admin panel with three permission levels: full access, custom (per-content-type permissions), or read-only. JWT auth uses the Users & Permissions plugin — register/login returns a JWT for authenticated API calls. API tokens are the recommended path for agent access — cleaner than JWT for server-to-server communication. Token permissions can be scoped per-content-type with CRUD granularity. Self-hosted deployments have full control over the auth infrastructure. For agents, API tokens with custom permissions provide appropriate least-privilege access. No OAuth for third-party integrations (would require custom implementation).

Documentation at docs.strapi.io is comprehensive — covering installation, content type creation, API usage, plugin development, and deployment. The REST API documentation covers filtering, sorting, pagination, and population with examples. GraphQL plugin documentation covers queries, mutations, and custom resolvers. The deployment guides cover popular hosting options (AWS, DigitalOcean, Heroku, Railway). Community is large and active — GitHub, Discord, and forum. Plugin marketplace provides community extensions. The documentation's strength: it covers the full journey from installation to production deployment. SDKs: JavaScript SDK (@strapi/sdk) for API interaction. For agents, the Quick Start Guide and REST API documentation are the essential entry points.