Authentication

All API requests require a project token passed as a Bearer token in the Authorization header.

Project tokens

Project tokens are created in the Diggama dashboard under Settings › API Tokens. Each token is scoped to specific blueprints and abilities, so you can create tokens with minimal permissions for each use case.

Managing tokens requires the Developer role (or higher) on the project.

Abilities

Ability	Description	Typical use case
View	List, get and export published resources	Production website fetching content
Preview	List, get and export all resources, including drafts and scheduled ones	Staging/preview environment
Create	Create new resources	Form submissions, user-generated content
Update	Modify existing resources, including their published_at	Programmatic content updates, CMS integrations
Delete	Remove resources	Content lifecycle automation
Publish	Bulk publish and unpublish; also allows creating resources	Scheduled publishing, editorial workflows

Permissions are scoped per blueprint. A token with view on blog-posts cannot access resources from products.

Two abilities apply to the whole project instead: blueprint:view (read every blueprint's structure) and blueprint:manage (also create, import, edit and delete blueprints and fields). They give no access to content.

A resource counts as published when its published_at is set and not in the future. See Publishing.

Required ability per endpoint

Endpoint	Accepted abilities
List, get, export	view or preview (view sees published resources only)
Blueprints list and get	view or preview on that blueprint, or the project-wide blueprint:view / blueprint:manage
Blueprints create, import, edit, delete, and their fields	blueprint:manage
Create (single and bulk)	create or publish
PUT / PATCH, bulk update	update
Delete, bulk delete	delete
Bulk publish / unpublish	publish

Setting published_at needs no extra ability: on create it is covered by create, on PUT/PATCH by update.

Creating a token

1. Open your project in the Diggama dashboard
2. Go to Settings › API Tokens
3. Click Create token
4. Name your token (e.g. "Production website")
5. Optionally set an expiration date (leave it blank for a token that never expires)
6. Select the blueprints and abilities. Under Blueprints (project structure), choose Manage for a token that creates or edits blueprints (a setup script, an AI agent); it works even on a project with no blueprint yet
7. Copy the token: it will only be shown once

Expiration, editing and regeneration

• An expired token is rejected with 401. The expiration date is set at creation and cannot be changed afterwards.
• Editing a token changes its abilities only; the token value stays the same.
• Regenerate issues a new value for the same token (same name, abilities and expiration). The old value stops working immediately. The new value is shown once.
• Revoke deletes the token.

Making authenticated requests

Pass the token as a Bearer token in the Authorization header:

curl "https://api.diggama.com/v2/resources/blog-posts" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer {token}"

JavaScript

const response = await fetch('https://api.diggama.com/v2/resources/blog-posts', {
  headers: {
    'Accept': 'application/json',
    'Authorization': `Bearer ${token}`
  }
});

Error responses

Status	Code	Description
401 Unauthorized	UNAUTHENTICATED	Missing, invalid, expired or revoked token
403 Forbidden	FORBIDDEN	Token does not have the required ability for this action or blueprint

{
  "error": {
    "code": "UNAUTHENTICATED",
    "message": "Authentication required.",
    "details": [],
    "timestamp": "2026-02-07T12:00:00+00:00",
    "request_id": "9b2f4c1e-6a7d-4f3b-8e21-0c5d9a7b1f42"
  }
}

See Errors for the full error format.