How Cactal works

Cactal is a website platform where organizations own websites, and every operation on a website is available to humans and agents through the same three interfaces. The dashboard also ships the built-in Cactal agent, which runs these same operations from a conversation beside your site.

The resource model

An organization is the unit of ownership and billing. It holds members, API keys, an audit log, and websites. A website belongs to exactly one organization and bundles everything one site needs:

Resource	What it holds	Concept page
Source code	Versioned pages, components, and site-wide files	Source code
CMS	Collections, fields, and content items	CMS
Assets	Uploaded images and files, served from the CDN	Assets
Domains	The platform subdomain and custom domains	Domains
Analytics	Traffic stats for the published site	Read analytics

Access to all of it flows through one capability-based permission model. See Access control.

Draft head and published version

Every website tracks two version numbers. headVersion is the draft: every source edit advances it by one, append-only. publishedVersion is the version the live site serves, and it only moves when you publish or roll back. This split means edits are never live until you decide. List the files that differ between head and published with GET /v1/websiteSourceCode/changes, inspect selected files with GET /v1/websiteSourceCode/files/diff, and discard drafts or restore any historical version with POST /v1/websiteSourceCode/head/restore. See Publishing.

A new website starts at headVersion: 1 with publishedVersion: null. Nothing is publicly served until the first publish, so you can build the entire site as a draft on any plan.

Three interfaces, one operation set

The dashboard, the REST API, and MCP all invoke the same underlying operations with the same authorization, rate limits, and audit pipeline. The built-in Cactal agent drives them from the dashboard on your behalf, and anything you can do in the dashboard, an outside agent can do with an API key.

Interface	Endpoint	Authentication
Dashboard	`https://app.cactal.ai`	Email and password, or email one-time code
REST API	`https://api.cactal.ai/v1`	`Authorization: Bearer $CACTAL_API_KEY`
MCP	`POST https://api.cactal.ai/v1/mcp`	`Authorization: Bearer $CACTAL_API_KEY`

The MCP server is stateless Streamable HTTP: POST /v1/mcp handles every message, and GET or DELETE on that path return 405. Each public REST endpoint appears as one MCP tool, named from its operation id — websites.create becomes the websites_create tool. tools/list only returns tools the key’s capabilities allow. The same website list, fetched over REST:

curl "https://api.cactal.ai/v1/websites" \
  -H "Authorization: Bearer $CACTAL_API_KEY"

{
  "items": [
    {
      "id": "V1StGXR8_Z5jdHi6B-myT",
      "organizationId": "kX9dQ2mNpL4wRt7vYc3Ub",
      "name": "Acme Marketing Site",
      "slug": "acme-marketing-site",
      "headVersion": 42,
      "publishedVersion": 40,
      "primaryHostname": "www.acme.com",
      "createdAt": "2026-06-01T12:00:00.000Z",
      "updatedAt": "2026-07-08T09:30:00.000Z"
    }
  ],
  "nextCursor": null
}

Control plane and content plane

Cactal keeps product surfaces and customer content on separate domain families. The control plane (cactal.ai) carries trusted product traffic; the content plane (cactal.app) carries public customer output.

Host	Plane	Role
`docs.cactal.ai`	Control	Permanent alias for the canonical documentation at `cactal.ai/docs`
`app.cactal.ai`	Control	Dashboard and session-authenticated app traffic
`api.cactal.ai`	Control	Public API and MCP; API-key auth only, no session cookies
`cactal.app`	Content	Permanent alias for the marketing site at `cactal.ai`
`<label>.cactal.app`	Content	Published websites on their platform subdomains
`draft--<label>.cactal.app`	Content	Draft previews of the head version, marked noindex
`cdn.cactal.app`	Content	Public asset delivery and image variants

This separation keeps session cookies and API keys away from user-generated content, and lets custom domains point at content-plane infrastructure only. Requests to api.cactal.ai never accept browser session cookies.

Next steps

Quickstart

Create a website, write a page, and publish it from the command line.

Websites

The website resource, its fields, and its lifecycle from create to transfer.

Build with the Cactal agent

Ask for changes beside the live preview, or bring your own agent over MCP.

Access control

Roles, capabilities, and how API keys map onto them.

Get started

Core concepts

Guides

Build with agents

Platform

How Cactal works

The resource model

Draft head and published version

Three interfaces, one operation set

Control plane and content plane

Next steps

Quickstart

Websites

Build with the Cactal agent

Access control

​The resource model

​Draft head and published version

​Three interfaces, one operation set

​Control plane and content plane

​Next steps

Quickstart

Websites

Build with the Cactal agent

Access control

The resource model

Draft head and published version

Three interfaces, one operation set

Control plane and content plane

Next steps