> ## Documentation Index > Fetch the complete documentation index at: https://cactal.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # List websites > Lists accessible websites. By default returns active websites: use `organizationId` to scope one organization, `scope=shared` without it for direct grants outside your memberships, or `scope=all` with it to combine both; supports `sort` by `createdAt`, `updatedAt`, or `name` and case-insensitive `search`, and each item includes `organizationSlug`, `primaryHostname`, and whether it is `shared`. Pass `status=deleted` with `organizationId` (requires organization-level trash access) to list restorable soft-deleted websites instead, each with its deletion time and purge deadline; deleted rows drop out when their 30-day restore window expires. Both modes use cursor pagination (default 20 per page, maximum 100). Fetch one website with `websites.get`. ## OpenAPI ````yaml /api-reference/openapi.json get /websites openapi: 3.1.0 info: title: Cactal API version: 1.0.0 description: >- The Cactal public API. Create, edit, publish, and operate websites programmatically. Authenticate every request with an API key sent as `Authorization: Bearer `. servers: - url: https://api.cactal.ai/v1 security: - apiKey: [] tags: - name: Documentation description: >- Search and read the Cactal product documentation for concepts, guides, agent workflows, platform behavior, and API operations. - name: Feedback description: >- Submit free-form product feedback from users and agents to the Cactal feedback inbox. - name: Websites description: >- Create and manage websites — the top-level resource that owns source code, content, assets, domains, and analytics. - name: Website editors description: >- Grant, list, and revoke website-scoped editor access, and invite collaborators to a single website by email. - name: API keys description: >- Create, scope, rotate, and revoke the API keys that authenticate programmatic and agent access. - name: Source code description: >- Read and edit the framework source files of a website draft. Mutations require an edit lease. - name: Publishing description: Validate, build, publish, and roll back website versions. - name: CMS collections description: >- Define the content model: collections of structured content owned by a website. - name: CMS fields description: Manage the typed fields that make up a collection schema. - name: CMS items description: >- Create, query, publish, and organize the content entries inside a collection. - name: Domains description: >- Manage platform subdomains and custom domains, including DNS verification and the primary domain. - name: Assets description: Upload and manage website files and images served from the Cactal CDN. - name: Media generation description: >- Generate reference-guided website images that are stored as ordinary Cactal CDN assets. - name: Project Context description: >- Upload private durable reference material that the website agent can search, read, and inspect. - name: Analytics description: >- Read first-party traffic analytics for a website and export datasets as CSV. - name: Organizations description: Manage organizations, members, and organization-wide invitations. - name: Audit log description: >- Read the immutable record of actions performed in an organization by users and API keys. - name: Billing description: >- Read billing state and manage plans, site capacity, and prepaid usage balance. Every billing operation requires the organization owner role, which API keys cannot hold — today these operations are performed from the dashboard, return 403 for API-key callers, and are hidden from MCP tool lists. paths: /websites: get: tags: - Websites summary: List websites description: >- Lists accessible websites. By default returns active websites: use `organizationId` to scope one organization, `scope=shared` without it for direct grants outside your memberships, or `scope=all` with it to combine both; supports `sort` by `createdAt`, `updatedAt`, or `name` and case-insensitive `search`, and each item includes `organizationSlug`, `primaryHostname`, and whether it is `shared`. Pass `status=deleted` with `organizationId` (requires organization-level trash access) to list restorable soft-deleted websites instead, each with its deletion time and purge deadline; deleted rows drop out when their 30-day restore window expires. Both modes use cursor pagination (default 20 per page, maximum 100). Fetch one website with `websites.get`. operationId: websites.list parameters: - name: organizationId in: query required: false schema: type: string minLength: 1 - name: cursor in: query required: false schema: type: string - name: limit in: query required: false schema: default: 20 type: integer minimum: 1 maximum: 100 - name: sort in: query required: false schema: type: string enum: - createdAt - updatedAt - name - name: search in: query required: false schema: type: string maxLength: 200 - name: scope in: query required: false schema: type: string enum: - shared - all - name: status in: query required: false schema: description: >- Which websites to list. Defaults to `active`. `deleted` returns the organization’s restorable soft-deleted websites (requires `organizationId` and organization-level trash access) with their deletion time and purge deadline. type: string enum: - active - deleted responses: '200': description: >- A page of websites: active rows with hostname and sharing info, or soft-deleted rows with trash timing when `status=deleted`. content: application/json: schema: type: object properties: items: type: array items: anyOf: - type: object properties: id: type: string description: Unique website id. organizationId: type: string description: Id of the organization that owns the website. name: type: string description: Display name, 1–200 characters. slug: type: string description: >- URL-safe identifier unique among active websites in the organization. customDomainsEnabled: type: boolean description: >- Whether custom domains are enabled. Enabling is owner-only and makes the website a billable site; custom domains can only be attached while `true`. headVersion: type: integer description: Latest draft source version number; starts at 1. publishedVersion: anyOf: - type: integer - type: 'null' description: >- Currently published version. `null` when the website is not published. createdAt: description: When the website was created. type: string format: date-time updatedAt: description: When the website was last modified. type: string format: date-time primaryHostname: anyOf: - type: string - type: 'null' description: >- Primary hostname the website is served from. `null` when none is assigned. organizationSlug: type: string description: >- URL slug of the organization that owns the website. shared: type: boolean description: >- `true` when access comes from a direct editor grant outside the caller’s organization memberships. faviconUrl: anyOf: - type: string - type: 'null' description: >- Public URL of the current favicon image. `null` when no available favicon is configured. Change it with the favicon endpoint. building: type: boolean description: >- `true` while the built-in Cactal agent has a queued or running run on the website. required: - id - organizationId - name - slug - customDomainsEnabled - headVersion - publishedVersion - createdAt - updatedAt - primaryHostname - organizationSlug - shared - faviconUrl - building additionalProperties: false - type: object properties: id: type: string description: Unique website id. organizationId: type: string description: Id of the organization that owns the website. name: type: string description: Display name, 1–200 characters. slug: type: string description: >- URL-safe identifier unique among active websites in the organization. customDomainsEnabled: type: boolean description: >- Whether custom domains are enabled. Enabling is owner-only and makes the website a billable site; custom domains can only be attached while `true`. headVersion: type: integer description: Latest draft source version number; starts at 1. publishedVersion: anyOf: - type: integer - type: 'null' description: >- Currently published version. `null` when the website is not published. createdAt: description: When the website was created. type: string format: date-time updatedAt: description: When the website was last modified. type: string format: date-time deletedAt: description: When the website was moved to the trash. type: string format: date-time purgeEligibleAt: description: >- When the trashed website and its data are permanently deleted. Restore before this deadline with `websites.restore`. type: string format: date-time required: - id - organizationId - name - slug - customDomainsEnabled - headVersion - publishedVersion - createdAt - updatedAt - deletedAt - purgeEligibleAt additionalProperties: false nextCursor: anyOf: - type: string - type: 'null' description: >- Opaque cursor for the next page. Pass it as the `cursor` parameter on the next request. `null` when this is the last page. required: - items - nextCursor additionalProperties: false '400': description: >- Validation failed. The response `message` names the first invalid field. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '401': description: Missing, invalid, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '403': description: The authenticated principal lacks the required capability. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '404': description: >- The resource does not exist or is outside the principal’s access scope. content: application/json: schema: $ref: '#/components/schemas/ServiceError' '429': description: >- Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header. content: application/json: schema: $ref: '#/components/schemas/ServiceError' components: schemas: ServiceError: type: object required: - kind - message description: >- Canonical error body returned by every non-2xx response. Extra fields carry error-specific details. properties: kind: type: string enum: - validation - unauthorized - forbidden - not_found - conflict - rate_limited - internal description: Stable, machine-readable error category. message: type: string description: Human-readable explanation of the failure. suggestion: type: string description: >- What to do next when the failure has a known fix; may name the exact operation to call. validValues: type: array items: type: string description: The acceptable values for the failing field, when the set is closed. additionalProperties: true securitySchemes: apiKey: type: http scheme: bearer description: >- Cactal API key. Create one in the dashboard or via `POST /apiKeys`. The plaintext key is shown once at creation. ````