Skip to content
On this page and tools
View as MarkdownOpen in ClaudeOpen in ChatGPTDownload OpenAPI specAPI changes feed
Available

Checked against the live API on October 18, 2026.

Report an error on this page

Hosted sites

Manage and edit a hosted site's files

A hosted site is a folder of files: pages, styles, scripts, images and a config.json. You can change any of them from the dashboard file manager, or let an AI agent do it through the API with its own key. Every change is checked, versioned and logged.

Available

Two ways to change a site

WhoHowNeeds
A personOpen the site in your dashboard and use the file manager: upload, edit, rename, delete, restore an earlier version.Access to the site's Space through the dashboard.
An AI agentThe file endpoints below, with an agent key.A key with read:site-files and, to change files, write:site-files.

Both use the same rules and the same publish path, so a change made by an agent looks exactly like one made by a person, and a person can undo it from the file manager.

Give an agent access

  1. Create an agent key. It starts in test mode.
  2. The agent asks for the permission with POST /dash/api/v1/agent/access-requests and a reason.
  3. The key owner, a manager or admin of the Space, approves it on the key page. It takes effect at once. Bynefit staff do not review it, because the Space is only changing its own site.
  4. To let the agent write for real, the owner moves the key from test mode to live. In test mode every write is a dry run.

If the owner stops being a manager or admin, the whole key switches off.

The calls

All calls are under /dash/api/v1 and take the key as a Bearer token.

CallPermissionWhat it does
GET /sitesreadThe Space's sites: id, name, slug, and whether writes are allowed right now.
GET /sites/{id}/files?prefix=&cursor=readFiles under a folder, 100 a page, with size and type. Pass next_cursor back as cursor.
GET /sites/{id}/files/{path}readOne file: text as content, binary as content_base64, and its sha256.
GET /sites/{id}/versions/{path}readThe saved versions of a file.
PUT /sites/{id}/files/{path}writeCreate or replace a file.
DELETE /sites/{id}/files/{path}?base_sha256=writeMove a file to the trash.

PUT takes content for text or content_base64 for binary, base_sha256 (required when the file already exists) and an optional dry_run. config.json is a file like any other: change a site's header, footer and modules by replacing it, and it is refused if it is not valid JSON.

Change a file safely

An agent must read a file before it replaces it. The hash from the read proves it saw the current version.

Read, then replacebash
# 1. find the site
curl -H "Authorization: Bearer $BYNEFIT_API_KEY" https://bynefit.com/dash/api/v1/sites

# 2. read the file; keep its sha256
curl -H "Authorization: Bearer $BYNEFIT_API_KEY" https://bynefit.com/dash/api/v1/sites/SITE_ID/files/index.html

# 3. replace it, sending that sha256 back
curl -X PUT -H "Authorization: Bearer $BYNEFIT_API_KEY" -H "Content-Type: application/json" \
  -d '{"content": "<!doctype html>...", "base_sha256": "SHA_FROM_STEP_2"}' \
  https://bynefit.com/dash/api/v1/sites/SITE_ID/files/index.html

Add "dry_run": true to a PUT to check a change without writing it. A dry run is validated, scanned for secrets and checked against storage. It writes nothing, uses none of the daily ceiling and leaves no log entry. A key in test mode gets a dry run from every PUT and DELETE without asking.

A successful write answers 200. If the file was saved but the live site could not be updated, it answers 202 with "published": false and a warning: the file is safe in the site source, so check published and retry or tell the owner.

What is checked on every write

A version is saved before every replace and delete. A delete moves the file to the trash and never removes it for good; purging stays with a person. Every live write and delete is recorded in the Space activity log with the key, path, size and hash. Dry runs are not logged. File content is never logged.

Errors

StatuserrorWhat to do
404site_not_found, file_not_foundCheck the id from GET /sites and the path from the file list.
409base_sha256_requiredThe file exists. Read it and send its hash.
409file_changedSomeone changed it after your read. The answer carries current_sha256. Read it again and re-apply your change.
409site_not_writableThe site is archived, scheduled for deletion or deleted. The message says which.
400invalid_cursorUse the next_cursor the last page returned.
413body_too_large, quota_exceededShrink the file, or free storage. Also file_too_large on a GET of a file over the size limit.
422invalid_path, protected_path, invalid_type, file_too_large, invalid_body, invalid_config_jsonFix the path, file type, size, body or JSON. Nothing was written.
429, 503agent_limits_unavailableThe write limits could not be checked, so nothing was changed. Try again in a minute.
500read_failed, version_failed, write_failed, delete_failedNothing was changed. Try again, and quote the request_id if it repeats.
405method_not_allowedUse the method in the calls table.
422secret_blockedThe file contains something that looks like a key. Remove it and use a secure request instead. findings says where.
429agent_write_budget_spentWait for midnight, server time.
403insufficient_scopeThe key lacks the permission. Request it and have the owner approve.

Quote the request_id from any error when you contact support.

What an agent cannot do

What exists and what does not