A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.
The Webflow API is how an app or AI agent works with a Webflow site: reading and editing CMS collection items, publishing a site, managing store products and orders, and reading form submissions. Access is granted through an OAuth token or a site API token, and each request is checked against the scopes the token carries, like cms:read or ecommerce:write, which set what it can read or change. Webflow can also push events to a registered endpoint, so an integration learns about a form submission or a publish without polling.
How an app or AI agent connects to Webflow determines what it can reach. There is a route for making calls, a route for receiving events, and a hosted server that exposes Webflow tools to agents, and each is governed by the token behind it and the scopes that token carries.
The Data API takes JSON request bodies, returns JSON, and pages through lists with an offset and limit, at https://api.webflow.com/v2. A call authenticates with a bearer token, either an OAuth access token or a site API token, and the token's scopes decide what it can reach.
Webflow POSTs a JSON payload to an HTTPS endpoint registered per site, one webhook per event trigger such as form_submission, site_publish, or collection_item_changed. The receiver verifies the request with the X-Webflow-Signature and X-Webflow-Timestamp headers against the app's client secret to confirm it came from Webflow.
Webflow publishes a first-party hosted Model Context Protocol server at https://mcp.webflow.com/sse that exposes Webflow tools to AI agents and LLM clients, authenticated by OAuth. It covers Data API operations like CMS item create, read, update, and delete, asset management, page metadata, and site metadata, plus Designer API tools that need the companion app open in the Webflow Designer. The server is open source at github.com/webflow/mcp-server.
A Data Client app uses the OAuth 2.0 authorization-code flow to get an access token on behalf of a Webflow user, with the scopes the user consents to. This is the route for apps installed across many sites, and it is the only route that can reach custom-code endpoints.
A site API token is generated in a single site's settings and grants server-side access scoped to that one site. It is quick to set up for an integration against a site the owner controls, but cannot call custom-code endpoints, which are limited to OAuth Data Client apps.
The Webflow Data API is split into areas an agent can act on, like sites, CMS collections and their items, pages, store products, orders, forms, and assets. Each area has its own methods, and writes in some areas publish content live, change inventory, or refund a customer.
Methods for listing sites, reading site details, and publishing a site.
Methods for listing collections and reading a collection's structure.
Methods for working with collection items, in their staged (draft) and live states.
Methods for listing pages and reading or editing page content.
Methods for working with store products and their SKUs.
Methods for reading orders, fulfilling them, refunding them, and adjusting inventory.
Methods for listing forms and reading or editing form submissions.
Methods for listing assets and uploading new ones to a site.
Methods for registering and managing the endpoints Webflow notifies.
Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.
| Method | Endpoint | What it does | Access | Permission | Version | |
|---|---|---|---|---|---|---|
SitesMethods for listing sites, reading site details, and publishing a site.3 | ||||||
| GET | /v2/sites | List all sites the authenticated token can access. | read | sites:read | Current | |
Read-only. Acts onsite Permission (capability) sites:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v2/sites/{site_id} | Retrieve details of a single site. | read | sites:read | Current | |
Read-only. Acts onsite Permission (capability) sites:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/publish | Publish a site to its domains, optionally to specific custom domains. | write | sites:write | Current | |
Pushes the current site content live; fires site_publish. Acts onsite Permission (capability) sites:writeVersionAvailable since the API’s base version Webhook event site_publishRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
CMS CollectionsMethods for listing collections and reading a collection's structure.2 | ||||||
| GET | /v2/sites/{site_id}/collections | List all CMS collections on a site. | read | cms:read | Current | |
Read-only. Acts oncollection Permission (capability) cms:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v2/collections/{collection_id} | Retrieve a collection's full schema, including its fields. | read | cms:read | Current | |
Read-only. Acts oncollection Permission (capability) cms:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
CMS ItemsMethods for working with collection items, in their staged (draft) and live states.6 | ||||||
| GET | /v2/collections/{collection_id}/items | List all items in a collection, in their staged (draft) state. | read | cms:read | Current | |
Read-only; returns draft state. Acts oncollection_item Permission (capability) cms:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/collections/{collection_id}/items | Create one or more collection items as drafts, up to 100 per request. | write | cms:write | Current | |
Creates staged items; they are not live until published. Acts oncollection_item Permission (capability) cms:writeVersionAvailable since the API’s base version Webhook event collection_item_createdRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v2/collections/{collection_id}/items | Update one or more collection items, up to 100 per request. | write | cms:write | Current | |
Edits staged items; publish separately to push live. Acts oncollection_item Permission (capability) cms:writeVersionAvailable since the API’s base version Webhook event collection_item_changedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /v2/collections/{collection_id}/items | Delete one or more collection items, up to 100 per request. | write | cms:write | Current | |
Removes staged items; fires collection_item_deleted. Acts oncollection_item Permission (capability) cms:writeVersionAvailable since the API’s base version Webhook event collection_item_deletedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/collections/{collection_id}/items/publish | Publish staged collection items so they appear on the live site. | write | cms:write | Current | |
Makes draft items visible publicly; fires collection_item_published. Acts oncollection_item Permission (capability) cms:writeVersionAvailable since the API’s base version Webhook event collection_item_publishedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/collections/{collection_id}/items/live | Create one or more collection items and publish them live in a single call. | write | cms:write | Current | |
Skips the draft step; content is live immediately. Acts oncollection_item Permission (capability) cms:writeVersionAvailable since the API’s base version Webhook event collection_item_publishedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
PagesMethods for listing pages and reading or editing page content.3 | ||||||
| GET | /v2/sites/{site_id}/pages | List all static pages on a site. | read | pages:read | Current | |
Read-only. Acts onpage Permission (capability) pages:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v2/pages/{page_id}/dom | Retrieve the static content (the DOM) of a page. | read | pages:read | Current | |
Read-only. Acts onpage Permission (capability) pages:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/pages/{page_id}/dom | Update the static text content of a page's DOM nodes. | write | pages:write | Current | |
Edits page copy in place; changes apply on next publish. Acts onpage Permission (capability) pages:writeVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Products & SKUsMethods for working with store products and their SKUs.4 | ||||||
| GET | /v2/sites/{site_id}/products | List all products on a store, with their SKUs. | read | ecommerce:read | Current | |
Read-only. Acts onproduct Permission (capability) ecommerce:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v2/sites/{site_id}/products/{product_id} | Retrieve a single product and its SKUs. | read | ecommerce:read | Current | |
Read-only. Acts onproduct Permission (capability) ecommerce:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/products | Create a product together with a default SKU. | write | ecommerce:write | Current | |
A product must be created with at least one SKU. Acts onproduct Permission (capability) ecommerce:writeVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/products/{product_id}/skus | Create one or more additional SKUs on an existing product. | write | ecommerce:write | Current | |
A SKU is stored as a CMS item under the product. Acts onsku Permission (capability) ecommerce:writeVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Orders & InventoryMethods for reading orders, fulfilling them, refunding them, and adjusting inventory.5 | ||||||
| GET | /v2/sites/{site_id}/orders | List a store's orders. | read | ecommerce:read | Current | |
Read-only. Acts onorder Permission (capability) ecommerce:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v2/sites/{site_id}/orders/{order_id} | Retrieve a single order. | read | ecommerce:read | Current | |
Read-only. Acts onorder Permission (capability) ecommerce:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/orders/{order_id}/fulfill | Mark an order as fulfilled, optionally notifying the customer. | write | ecommerce:write | Current | |
Changes the order status to fulfilled. Acts onorder Permission (capability) ecommerce:writeVersionAvailable since the API’s base version Webhook event ecomm_order_changedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/orders/{order_id}/refund | Refund an order through the connected payment provider. | write | ecommerce:write | Current | |
Moves real money back to the customer; not reversible. Acts onorder Permission (capability) ecommerce:writeVersionAvailable since the API’s base version Webhook event ecomm_order_changedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v2/collections/{sku_collection_id}/items/{sku_id}/inventory | Update the tracked inventory quantity for a SKU. | write | ecommerce:write | Current | |
Sets or increments stock; fires ecomm_inventory_changed. Acts oninventory Permission (capability) ecommerce:writeVersionAvailable since the API’s base version Webhook event ecomm_inventory_changedRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
FormsMethods for listing forms and reading or editing form submissions.3 | ||||||
| GET | /v2/sites/{site_id}/forms | List all forms on a site and their schemas. | read | forms:read | Current | |
Read-only. Acts onform Permission (capability) forms:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v2/sites/{site_id}/forms/{form_id}/submissions | List the submissions captured by a form. | read | forms:read | Current | |
Read-only; submissions contain whatever the form collected. Acts onform_submission Permission (capability) forms:readVersionAvailable since the API’s base version Webhook event form_submissionRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v2/sites/{site_id}/form_submissions/{form_submission_id} | Update the stored data on a single form submission. | write | forms:write | Current | |
Edits a captured submission in place. Acts onform_submission Permission (capability) forms:writeVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
AssetsMethods for listing assets and uploading new ones to a site.2 | ||||||
| GET | /v2/sites/{site_id}/assets | List the assets in a site's library. | read | assets:read | Current | |
Read-only. Acts onasset Permission (capability) assets:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/assets | Upload a new asset to a site, returning a presigned upload target. | write | assets:write | Current | |
Registers the asset, then the file is uploaded to the returned target. Acts onasset Permission (capability) assets:writeVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
WebhooksMethods for registering and managing the endpoints Webflow notifies.2 | ||||||
| GET | /v2/sites/{site_id}/webhooks | List the webhooks registered on a site. | read | sites:read | Current | |
Read-only. Acts onwebhook Permission (capability) sites:readVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v2/sites/{site_id}/webhooks | Register a webhook to receive a chosen event for a site. | write | sites:write | Current | |
The scope needed depends on the trigger_type chosen. Acts onwebhook Permission (capability) sites:writeVersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Webflow can notify an app when something happens on a site, like a form being submitted, a site being published, or a CMS item changing. It POSTs a payload describing the event to a registered endpoint, so an integration learns about activity without polling.
| Event | What it signals | Triggered by |
|---|---|---|
form_submission | A visitor submitted a form on the site. The payload includes the submitted field data. | /v2/sites/{site_id}/forms/{form_id}/submissions |
site_publish | A site was published to one or more of its domains. | /v2/sites/{site_id}/publish |
collection_item_created | A new CMS collection item was created. | /v2/collections/{collection_id}/items |
collection_item_changed | An existing CMS collection item was updated. | /v2/collections/{collection_id}/items |
collection_item_deleted | A CMS collection item was deleted. | /v2/collections/{collection_id}/items |
collection_item_published | A CMS collection item was published to the live site. | /v2/collections/{collection_id}/items/publish/v2/collections/{collection_id}/items/live |
ecomm_new_order | A new ecommerce order was placed on the store. | /v2/sites/{site_id}/orders |
ecomm_order_changed | An ecommerce order changed, like being fulfilled or refunded. | /v2/sites/{site_id}/orders/{order_id}/fulfill/v2/sites/{site_id}/orders/{order_id}/refund |
ecomm_inventory_changed | The tracked inventory for a SKU changed. | /v2/collections/{sku_collection_id}/items/{sku_id}/inventory |
Webflow limits how fast an app can call, by a per-minute request rate that depends on the site's plan, and returns headers on every response so an integration can track what it has left.
Webflow meters requests by a per-minute rate tied to the site's plan, tracked separately for each API key. Starter and Basic sites allow 60 requests per minute, while CMS, Ecommerce, and Business sites allow 120 per minute; Enterprise limits are set on request. Going over returns HTTP 429 with a Retry-After header naming how long to wait, typically 60 seconds. Every response also carries X-RateLimit-Limit and X-RateLimit-Remaining so an integration can track its remaining budget, and Webflow recommends webhooks over polling to stay within the limit.
List endpoints page with offset and limit query parameters: limit sets the page size and offset sets where the page starts, and the response includes a pagination object with the total count so a caller knows how many pages remain. CMS item lists default to a page size of 100.
Bulk CMS item endpoints accept up to 100 items per create, update, or delete request. A list page returns at most 100 items. Asset uploads are size-limited by the site's plan.
The status codes an agent should handle, and what to do about each.
| Status | Code | Meaning | What to do |
|---|---|---|---|
| 400 | bad_request | The request was malformed, like a missing required field or an invalid value. | Read the message and details array, fix the request body, and resend. |
| 401 | not_authorized | The request lacks valid authentication credentials, like a missing or expired token. | Send a valid bearer token, and refresh an expired OAuth access token. |
| 403 | forbidden | The token is valid but lacks the scope or permission the request needs. The body names the missing scopes. | Grant the scope the endpoint requires, then re-authorize the token. |
| 404 | resource_not_found | The requested resource does not exist or is not visible to this token. | Verify the site, collection, item, or order ID and the token's access. |
| 409 | conflict | The request conflicts with the current state of the resource, like a duplicate or a concurrent change. | Re-read the resource, resolve the conflict, and retry. |
| 429 | too_many_requests | The per-minute rate limit was exceeded. | Wait for the time in the Retry-After header, then retry with backoff. |
| 500 | internal_error | An unexpected error occurred on Webflow's side. | Retry with backoff, and contact Webflow support if it persists. |
Webflow runs a single major version of the Data API, and ships dated changes through release notes, including breaking changes that require pinning a version on write requests.
The Data API runs under a single major version, v2, in every path. Webflow does not mint a new version string for additive features; it ships dated changes through its release notes and versions breaking changes by date. Newer additive updates get a history entry without changing the v2 path.
The Analyze API moved to general availability, letting an app read a site's analytics through five reports, filterable by dimensions like country, device, or traffic source.
Webflow disabled User Accounts on all sites and removed the related APIs and webhooks. Integrations that managed site memberships through the API lost those endpoints.
Webflow added bulk authoring, editing, and deleting of CMS items, supporting up to 100 items per request, to ease rate-limit pressure and manage large content sets more efficiently.
Pin a version on writes and move up on a schedule that suits the integration.
Webflow API changelog ↗Bollard AI sits between a team's AI agents and Webflow. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.