SveltyCMS provides a comprehensive programmatic surface for building custom frontends, automating workflows, and synchronizing external data. Built on a architecture that supports the fastest unified OpenAPI specification, it enables maximum flexibility for any setup — from simple headless blogs to enterprise-grade multi-tenant platforms.

---

⚡ Core Access Patterns

Pattern	Context	Latency	Best For
🎯 Remote Functions	Client→Server (.server.ts)	Typed	Auth, Setup, User profile forms
⚡ Local SDK	Server-side (.server.ts)	0–5ms	Native SvelteKit, high-throughput
🌐 REST API	External (Mobile, Apps)	50–150ms	Simple CRUD & Integrations
📊 GraphQL API	Frontend (React, Vue, SPA)	50–200ms	Complex data fetching
🔌 GraphQL Subscriptions	Real-time (WebSocket)	<50ms	Live updates, collaborative editing
📖 OpenAPI Spec	Documentation & SDKs	Unified	Fastest automated client generation
🎮 Developer & API Playground	In-App Console (/config/api)	Realtime	Interactive testing & code gen

---

🎯 Remote Functions (2026 Architecture) {#remote-functions-2026-architecture}

SveltyCMS uses SvelteKit Remote Functions (.server.ts files) for type-safe client-to-server communication. These replace traditional form actions and manual fetch() calls with fully typed async functions that provide complete TypeScript inference between components and server logic.

File Structure

src/routes/
├── login/
│   ├── +page.server.ts     ← load, OAuth redirects, 2FA, resetSetup
│   └── auth.server.ts      ← signIn, signUp, forgotPW, resetPW, prefetch (592 lines)
├── setup/
│   ├── +page.server.ts     ← load, installDriver (~200 lines)
│   └── setup.server.ts     ← testDatabaseConnection, seedDatabase, completeSetup, testEmailConnection, testRedisConnection (665 lines)
└── (app)/user/
    ├── +page.server.ts     ← load
    └── user.server.ts      ← uploadAvatar, updateUserProfile, createToken, exportUserData, anonymizeAccount

Enterprise Gains (Measured)

Metric	Before (Form Actions)	After (Remote Functions)
login/+page.server.ts	1,625 lines	310 lines (-81%)
setup/+page.server.ts	1,345 lines	~200 lines (-85%)
Type safety	formData.get("email")?.toString()	signIn(email: string, password: string, event)
Rate limiting	Embedded in monolithic file	Explicit RateLimiter per function — auditable
Timing-attack mitigation	Buried in 1,625-line file	Explicit argon2 verify visible in signIn
Audit logging	Interleaved with form parsing	Fire-and-forget at function boundaries
Testability	Requires full SvelteKit event mock	Plain async functions with typed params
Security audit surface	2,970 lines across 2 monoliths	510 lines (page servers) + 1,524 lines (organized .server.ts)

Available Remote Functions

Module	Functions	Security Preserved
login/auth.server.ts	signIn, signUp, forgotPW, resetPW, prefetchFirstCollection	Rate limiting, Argon2id, timing-attack mitigation, audit logging
setup/setup.server.ts	testDatabaseConnection, seedDatabase, completeSetup, testEmailConnection, testRedisConnection	Valibot validation, setup gating, preset-based seeding
(app)/user/user.server.ts	uploadAvatar, deleteAvatar, updateUserProfile, verifyPassword, batchUserAction, createToken, updateToken, deleteToken, exportUserData, anonymizeAccount	CSRF tokens, RBAC

What Stays as Form Actions

OAuth redirects (signInOAuth, signInOAuthGithub), 2FA verification (verify2FA — hidden form for CSRF), setup reset (resetSetup — disk I/O), and driver installation (installDriver — spawn-based) remain as traditional form actions because they involve browser redirects, hidden form patterns, or OS-level operations.

---

🛡️ Unified Gatekeeper Architecture

SveltyCMS uses a high-performance Unified Gatekeeper (src/routes/api/[...path]) that dispatches requests to domain-specific handlers.

Key Benefits

• Zero-Latency Dispatching: Internal server-to-server calls bypass HTTP overhead via the LocalCMS bridge.
• Fail-Closed Security: Every request must pass central authorization before being dispatched.
• ETag Conditional Requests: GET 200 responses include an ETag. Collection find/entry GETs use a weak collection-generation validator (W/"cv1|…") so If-None-Match can 304 before the database query; other GET handlers use a size-gated content hash of the body (FNV-1a up to 1 KiB, native SHA-256 above). See Collections.
• API Versioning: All responses include X-API-Version: 1 header. /api/v1/ path prefix automatically routes to the current API version.

---

📚 Complete API Reference (Handler Based)

Content & Data

• 📚 Collections (collections.ts) — Entry CRUD, schema discovery, and revisions.
• 🔍 Content & Search (content.ts) — Global search, SSE events, and GraphQL.
• 🖼️ Media (media.ts) — Asset uploads, processing, and folder management.

Identity & Access

• 👥 Auth & Identity (auth.ts) — Login, 2FA, SAML SSO, and Profiles.
• 🔐 Tokens (tokens.ts) — Invitation links and programmatic API keys.
• 🌐 SCIM 2.0 (scim.ts) — Standardized user provisioning.

System & Infrastructure

• ⚙️ System & Setup (system.ts / setup.ts) — Settings, widgets, webhooks, AI translation, and job scheduling.
• 📈 Dashboard (dashboard.ts) — Metrics, logs, and health data.
• 🛠 Utilities (utility.ts) — Cache, trash, and email services.
• 🎨 Theme & Design System (theme.ts) — Admin theme config, multi-theme CRUD, preset import, and public branding.

New GET /api/health, POST /api/system-jobs, POST /api/ai/translate

📦 Data Operations

APIs for configuration promotion, content transfer, migrations, importers, backups, and content sync.

• 📤 Configuration Promotion — Promote CMS structure between environments with plan-first workflow.
• 📦 Content Transfer — Export/import editorial content as portable packages with NDJSON streaming.
• 🔄 Data Migrations — Idempotent schema/data transformations with locking and risk scoring.
• 📥 External Importers — Import from WordPress, Drupal, CSV, JSON, and other sources.
• 💾 Backups & Restore — Encrypted disaster recovery with manifest validation and restore plans.
• 🔁 Content Sync — Controlled cross-environment content synchronization.

---

🎮 In-App Developer & API Playground {#developer-playground}

SveltyCMS provides an integrated Developer & API Playground located at /config/api (accessible to administrators and users with the developer role).

Key Capabilities

1. REST API Explorer:

   • Live synchronization with the unified OpenAPI 3.1 specification (/api/openapi.json).
   • Dynamic path, method, and parameter selectors with schema auto-completion.
   • Live execution against the active server with formatted JSON output, status codes, and latency metrics.

2. GraphQL IDE:

   • Interactive query, mutation, and subscription editor.
   • Built-in schema introspection against /api/graphql.
   • Variables panel with JSON validation.

3. Multi-Language Code Generator: Every selected endpoint dynamically generates copy-paste ready client code across four language ecosystems:

   • TypeScript / JavaScript: Native fetch() client with typed headers and error handling.
   • Python: requests client with session configuration.
   • cURL: Command-line invocation with Bearer auth headers.
   • SvelteKit LocalCMS: Zero-latency, zero-serialization internal server function (.server.ts) call pattern bypassing HTTP overhead.

4. Multi-Tenant & Security Context:

   • Allows switching active tenantId to test isolation rules.
   • Configurable bearer token authentication or session cookie binding.

---

📡 Response Strategy

All REST endpoints follow a unified response shape:

Success (200 / 201)

{ "success": true, "data": { ... } }

Error (4xx / 5xx)

{ "success": false, "error": "UNAUTHORIZED", "message": "Invalid Bearer token." }

---

Next Steps: Start with the Collections Reference for data fetching. For real-time updates, see Content & Search. For type-safe client-server calls, use Remote Functions.